PDF malware analysis — malicious · 6767b5ff4ea83a33

MALICIOUS

PDF

44.5 KB Created: 2020-06-03 21:39:15 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 40787a0ead346dee61e63730ca41109a SHA-1: 167460da6531ce5a63e9d5cca871eb0b09bd5121 SHA-256: 6767b5ff4ea83a331ce544248582336f378d3045efdcbfbb6508d97486f1efc7

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, directing users to various PDF files hosted on different domains. The document body mentions "Amerikan pastas1 1 indir mobil", suggesting a lure for potentially malicious content. The ML classifier strongly flagged this PDF as malicious, indicating a high probability of malicious intent.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://goldcoastdigitalprinting.com/uploads/1/3/0/7/130776517/130776517.html#amerikan+pastas%25C4%25B1+1+indir+mobil
- http://globetreka.com/uploads/1/3/0/6/130620435/detud.pdf
- http://secondlookdds.com/uploads/1/3/1/4/131407453/6b6cd.pdf
- http://midwestmines.com/uploads/1/3/1/0/131069887/farabov.pdf
- http://sblboutique.com/uploads/1/3/1/3/131398362/94d0f63c.pdf
- http://advancedlimestone.com/uploads/1/3/0/5/130589217/8892366608.pdf
- http://fgo-overture.com/uploads/1/3/1/6/131607237/858c25b.pdf
- http://clochconcrete.com/uploads/1/3/0/2/130271153/davesonopibes.pdf
- http://ubiomes.com/uploads/1/3/0/9/130968912/80f48137fc6b.pdf
- http://goldcoastdigitalprinting.com/uploads/1/3/0/7/130776517/terms.html
- http://goldcoastdigitalprinting.com/uploads/1/3/0/7/130776517/dmca.html
- http://goldcoastdigitalprinting.com/uploads/1/3/0/7/130776517/policy.html
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://jemuxotuwigi.files.wordpress.com/2020/05/27130550751.pdf
- https://wakogokanexu.files.wordpress.com/2020/05/bimigakisil.pdf
- https://gufakiv.files.wordpress.com/2020/06/20376191200.pdf
- https://vasoponox.files.wordpress.com/2020/05/sigud.pdf
- https://povaduw.files.wordpress.com/2020/05/54555669221.pdf
- https://datefakifeba.files.wordpress.com/2020/06/53339282688.pdf
- https://kitafolek.files.wordpress.com/2020/06/77128064702.pdf
- https://bitepon.files.wordpress.com/2020/06/rubatirisazimazakot.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000769e.bin` `12ed2c68f3390da384ff43bf7448dadd63856d3760ca2b1f66233b3604419357`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x769E	15356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.