Malicious PDF — malware analysis report

Static analysis result for SHA-256 6957f9f035eef14b…

MALICIOUS

PDF

43.0 KB Created: 2020-04-09 12:31:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 737dfd89d7b72c4e812bce841a354132 SHA-1: 38d4d00b4fdd5abfdee04415816d184597e266a0 SHA-256: 6957f9f035eef14b64722fed941877dc4511a7bd1e91936bd11ce6febc1563a8
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. While no scripts were directly extracted, the embedded URLs are the primary indicators of malicious intent, likely serving as lures or downloaders.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://texasoilfieldmafia.org/uploads/1/3/0/5/130589431/130589431.html#que+quiere+decir+prescribir+un+delito
    • http://magnetsnmoredesigns.com/uploads/1/3/0/4/130435631/3786508.pdf
    • http://pyperslegacy.com/uploads/1/3/1/0/131070045/zuzalewozata.pdf
    • http://spyoptionstrade.com/uploads/1/3/0/5/130539022/7498202.pdf
    • http://vintagerosewomensshelter.com/uploads/1/3/0/2/130270923/4070105.pdf
    • http://bodyispa.com/uploads/1/3/0/7/130739575/popimamiloz_bipap_bajuwexiso.pdf
    • http://kalindakreations.com/uploads/1/3/0/2/130288682/5760607.pdf
    • http://princessjodie.com/uploads/1/3/0/6/130604225/xefop.pdf
    • http://cjdavidsonmusic.com/uploads/1/3/0/8/130874594/mubibokavusa.pdf
    • http://theinformaters.com/uploads/1/3/0/6/130604770/jimadepixikesime.pdf
    • http://muscle-memory-holistics.com/uploads/1/3/0/8/130813896/xuzapefuxej_rixejow.pdf
    • http://garynolan.ca/uploads/1/3/0/6/130604699/jikitotekit_duribudawubug.pdf
    • http://marlertowing.com/uploads/1/3/0/3/130379527/juvilanipoge_juxifovepax.pdf
    • http://dreamingofdonuts.org/uploads/1/3/0/7/130776580/wurutesale.pdf
    • http://cass-travis-art.com/uploads/1/3/0/2/130272631/sivawunumeku_niguvuma_pazebulomefimul.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000810a.bin
1a6430bf63a619f675125569b3613a213bece8e6e71e64c9adb29fb72198d75b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x810A 8476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.