PDF malware analysis — malicious · 6a102c31983b58a3

MALICIOUS

PDF

52.4 KB Created: 2020-03-21 20:44:39 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 3d5bdabf2f12e6b5781dc287a6a5d6ee SHA-1: 6170e1964e3cdcf2975ca15a7c97a3831b76ace6 SHA-256: 6a102c31983b58a346bb98f02a0f3a4e599afe313263ddf4bb9a87d5830a69db

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1105 Ingress Tool Transfer

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML classifier also strongly indicated maliciousness. The primary purpose appears to be directing users to a network of linked PDF files, potentially for SEO spam or to host malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://jhrpropertyltd.com/uploads/1/3/0/5/130588332/130588332.html#que+son+los+alcanos+alquenos+y+alquinos+ejemplos
- http://vonraesfeld.com/uploads/1/3/0/5/130551457/1008649.pdf
- http://cycotron.com/uploads/1/3/0/5/130550981/vobutiju.pdf
- http://djtphotography1.com/uploads/1/3/0/5/130588799/xugugude.pdf
- http://squeezeapparel.com/uploads/1/3/0/6/130621404/7552651.pdf
- http://mountainmadebaby.com/uploads/1/3/0/5/130590779/belikoditem-netunuz-perukuvoval.pdf
- http://kmajzoub.com/uploads/1/3/0/7/130739094/moxogolakotofu.pdf
- http://2mdesignlab.com/uploads/1/3/0/6/130639468/jasulodediwonex.pdf
- http://marineshucomr9123.com/uploads/1/3/0/5/130551144/6103462.pdf
- http://chinookandhobbywest.com/uploads/1/3/0/9/130969427/965436.pdf
- http://mail.kimstarksministries.com/uploads/1/3/0/3/130313086/rimesadizitefaxo.pdf
- http://bhspaws.com/uploads/1/3/0/8/130813100/sumajome.pdf
- http://courageblogs.com/uploads/1/3/0/6/130621068/gubagozubabuku.pdf
- http://asraifae.com/uploads/1/3/0/7/130738566/mitawujumiga.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
- http://dejavu.sourceforge.net
- http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007f2c.bin` `ba24d381ddf390f782b6c4b0fa937e1d638f7b0e13e30e6520c78ec6c2620097`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F2C	9752 bytes
`font_01_sfnt_off0000a208.bin` `24851141491752b6b17eb160a376fec70fe04ebcc1738092781cc165f5248226`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xA208	3080 bytes
`font_02_sfnt_off0000ace7.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xACE7	16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.