Malicious PDF — malware analysis report

Static analysis result for SHA-256 69ac83bc57f656ad…

MALICIOUS

PDF

43.6 KB Created: 2020-03-29 15:14:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d81ec803306bdabed85face9e955ec94 SHA-1: 535cee1c7668e4e802f9cc6dd228593a312ebfab SHA-256: 69ac83bc57f656ad35899d003bb89e58e4af5222ae4f1118bbcc9b142f77589d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a PDF link farm. The primary URL points to an HTML file which itself contains further links to PDF documents. This suggests a tactic to manipulate search engine results or distribute content through a network of linked PDFs. No scripts were extracted, and the document body is largely unreadable binary data.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cfthomas.com/uploads/1/3/0/8/130813550/130813550.html#seleccionar+todo+el+texto+en+word+mac
    • http://vantagepointmanagement.com/uploads/1/3/0/2/130289311/53147.pdf
    • http://distinctivegiving.org/uploads/1/3/0/7/130738647/guwuwemekiwolu_bejaka_jufijejet_fasuxumu.pdf
    • http://vast-2.com/uploads/1/3/0/5/130551132/7879553.pdf
    • http://stepuptomike.com/uploads/1/3/1/3/131383708/gerose-zapaxutok-difijudelatij.pdf
    • http://vivangelismo.com/uploads/1/3/0/2/130289669/3401047.pdf
    • http://starlightsteam.com/uploads/1/3/0/6/130603867/toriwoxedovi-kunovavoba-tugorikada.pdf
    • http://roughneckproductions.com/uploads/1/3/0/5/130590710/velezefelati-fuzikivax-rigerimifam-rikuzidof.pdf
    • http://tzonick.ca/uploads/1/3/0/7/130775868/tawozejejojilod.pdf
    • http://galitshvo.com/uploads/1/3/0/4/130436224/mipujizalibufapagu.pdf
    • http://gina-lauck-realtor.com/uploads/1/3/0/5/130543685/5beac60dcb71d.pdf
    • http://healingtouchreiki7.com/uploads/1/3/0/7/130740483/9258204.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080f8.bin
3ebd499f2ce74d32798a69e0d130c569269c13d1cff41f1ea100a75a65c6fb66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80F8 8592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.