Malicious PDF — malware analysis report

Static analysis result for SHA-256 67564ad036dc7e79…

MALICIOUS

PDF

37.4 KB Created: 2020-03-29 05:11:19 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 48e4d799196a7d6ccf445f6e55520d2a SHA-1: 9e6bf0a2438d379feb6950ffeb051a07c2f9d7f6 SHA-256: 67564ad036dc7e79903ed87769304f9aaed54c8742d301e43fbe59cab5c11531
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links to other PDF files hosted across numerous domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary URL found in the document body also points to a similar structure. This suggests a campaign focused on link farming or distributing secondary payloads via these external links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-75-252.mgwnet.com/uploads/1/3/1/3/131379643/131379643.html#ejemplos+de+oraciones+con+nexos+que+introducen+ideas
    • http://milablooms.net/uploads/1/3/0/5/130590569/gataferi.pdf
    • http://treetopreptile.com/uploads/1/3/0/7/130775978/bixopawadatob_dugufivag_mofilunenew.pdf
    • http://themiraclediet.org/uploads/1/3/0/7/130775033/wivuxe-notebilalabife.pdf
    • http://tahoegoogletours.com/uploads/1/3/0/4/130435597/zeporor.pdf
    • http://www.affirmationsofalexis.com/uploads/1/3/0/6/130604688/77d374ef3bf444.pdf
    • http://theplansihave.com/uploads/1/3/0/4/130477775/bc444394f64.pdf
    • http://hostmaster.activelyoutdoors.co.uk/uploads/1/3/0/3/130323724/lagusew.pdf
    • http://billtheinspector.com/uploads/1/3/0/6/130604083/8360596.pdf
    • http://pan-education.com/uploads/1/3/0/2/130287529/6209089.pdf
    • http://mail.realmastery.com.au/uploads/1/3/0/5/130551962/769305.pdf
    • http://rockcitybands.com/uploads/1/3/0/3/130312914/residapejuluwij.pdf
    • http://dallastexastreeremoval.com/uploads/1/3/0/2/130288348/a61e52710d.pdf
    • http://rivetingrozie.com/uploads/1/3/0/6/130639741/rebexoxow.pdf
    • http://estatecomputers.net/uploads/1/3/0/6/130639092/gabunalivagadadege.pdf
    • http://conniesulpasso.com/uploads/1/3/0/7/130738914/692f2c88997.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068c7.bin
3d03085d0eb20b65246a84f78a9d843694e75e3a5d5624b25415aa1cb6ec7ce1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68C7 8052 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.