Malicious PDF — malware analysis report

Static analysis result for SHA-256 681395bcfcd11808…

MALICIOUS

PDF

31.9 KB Created: 2020-03-26 14:50:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 0f5a2a702598edae5611700bc4dcd443 SHA-1: 96c50a11dd8ee75bac27b6e5fcadae9e952f1393 SHA-256: 681395bcfcd11808eb75543fc88eba09db6d9328e20f417813416618294a1a5f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains numerous embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which are likely intended to redirect users to malicious websites. The document body, though heavily obfuscated, contains a URL that appears to be a lure for free movie streaming, a common social engineering tactic. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://backyardbros.com/uploads/1/3/0/9/130969543/130969543.html#world+war+z+full+movie+free+online+123
    • http://fitztek.net/uploads/1/3/0/5/130551177/kexefemipikogo.pdf
    • http://www.dakotaironworks.com/uploads/1/3/0/8/130874130/xitekojaxi.pdf
    • http://cimisupport.com/uploads/1/3/0/6/130621447/1619542.pdf
    • http://tanenwerx.com/uploads/1/3/0/7/130739706/miriku.pdf
    • http://dichvuseowebsitehanoi.com/uploads/1/3/0/6/130604494/9942420.pdf
    • http://gutbustinggames.com/uploads/1/3/0/2/130289277/219d526df77.pdf
    • http://papomundo.org/uploads/1/3/0/3/130313024/vefivisobugoliwuzobe.pdf
    • http://polestartechnologyassociates.com/uploads/1/3/0/6/130605194/xiteru.pdf
    • http://www.pavon.dk/uploads/1/3/0/2/130287457/242e63e.pdf
    • http://nathanbrooker.com.au/uploads/1/3/0/7/130738712/sipilivetunoso.pdf
    • http://santafedatahub.com/uploads/1/3/0/6/130604549/79278b2c2b.pdf
    • http://ohanaappraisals.com/uploads/1/3/0/8/130813592/felaxesubibizinat.pdf
    • http://www.krphotography.net/uploads/1/3/0/8/130815482/7fa89c22d641.pdf
    • http://jamiejolley.com/uploads/1/3/0/5/130551174/bikajasoreliso.pdf
    • http://www.paulanthonystewart.com/uploads/1/3/0/7/130740556/putiridasuxiv_gonag.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005617.bin
92d139f7fca606c0b65c219c2b50954d9b7940dbf26cc5a89af9edc3cc37167a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5617 7132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.