Malicious PDF — malware analysis report

Static analysis result for SHA-256 690ac51d4ef6c92e…

MALICIOUS

PDF

55.5 KB Created: 2020-03-26 05:44:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: f5b2990b32726a657c82864eec6f930c SHA-1: 8d03eb0c16213ecf2e2093e5e8b8eb8e2f02d82a SHA-256: 690ac51d4ef6c92e9fd1475d01e2dbec3fd661460d2c4ad41b1891e6e1991f20
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were explicitly extracted, the presence of numerous external links suggests an attempt to redirect the user to potentially malicious content or for SEO manipulation purposes.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://demureduchessfilms.com/uploads/1/3/0/5/130588865/130588865.html#formula+estructural+de+la+sacarosa PDF link annotation
    • http://www.sacredsanpedro.com/uploads/1/3/0/4/130479350/6387ae11393.pdfIn PDF document text
    • http://seekdrun.com/uploads/1/3/0/4/130483940/bupolusifatezeb-sexupuze-mipopijivugif-giwikibeserexu.pdfIn PDF document text
    • http://blackskyracing.com/uploads/1/3/0/5/130589146/2981409.pdfIn PDF document text
    • http://ajuristascatolicos.com/uploads/1/3/0/9/130969358/buwuwagofenume_serima_sujizov.pdfIn PDF document text
    • http://shedtastic.net/uploads/1/3/0/3/130379902/dapavaturetil.pdfIn PDF document text
    • http://xn--distonayblefaroespasmo-2bc.com/uploads/1/3/0/6/130620665/17b843c.pdfIn PDF document text
    • http://moment2meditate.org/uploads/1/3/0/5/130539203/kutojejov-xubokozapum-vareneri.pdfIn PDF document text
    • http://www.nathanbohachvibes.com/uploads/1/3/0/5/130589174/3073952.pdfIn PDF document text
    • http://theartoftea.org/uploads/1/3/0/2/130270911/3072301.pdfIn PDF document text
    • http://lifeonislandtime.com/uploads/1/3/0/6/130603980/1252028.pdfIn PDF document text
    • http://yoshini.com/uploads/1/3/0/7/130776541/6c4ef52.pdfIn PDF document text
    • http://dgodbeats.com/uploads/1/3/0/7/130776661/e436170f162f3bd.pdfIn PDF document text
    • http://mxrkz.com/uploads/1/3/0/6/130620519/vomitirogas_bixemurifaba.pdfIn PDF document text
    • http://catchwwweb.com/uploads/1/3/0/5/130540540/3997690.pdfIn PDF document text
    • http://official-rivercoveresidences-ec.com/uploads/1/3/0/7/130738512/8841941.pdfIn PDF document text
    • http://benjohnsontragedy.com/uploads/1/3/0/8/130813618/3d3921d.pdfIn PDF document text
    • http://davisairrepair-nwa.com/uploads/1/3/0/5/130543640/d862f3f000.pdfIn PDF document text
    • http://artstudiogirl.com/uploads/1/3/0/6/130639884/e022c.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008c7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C7C 9684 bytes
SHA-256: e839ad002b06de9e7d4138181653057becd2e9790032134040a2abc524006cff
font_01_sfnt_off0000ae9f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAE9F 2732 bytes
SHA-256: 0ef1112e50e2a86488aadde4d8a477a3649c66578d8f2a84f2c6ad20bbddbbf8
font_02_sfnt_off0000b84c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB84C 16264 bytes
SHA-256: 9ab890d4d27036e818a17f6d3cd754739c047151a1b196ef51c3b3ecea758c95

Open this report in the interactive analyzer, or submit your own file for analysis.