Malicious PDF — malware analysis report

Static analysis result for SHA-256 70241a207ac73b6d…

MALICIOUS

PDF

38.9 KB Created: 2020-05-23 20:09:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d0097968e133bc496a47ebdcc7f9f2b0 SHA-1: d0563e6d969198a2f41de621940fdea6bd7c6a72 SHA-256: 70241a207ac73b6d1d56f3778fb2a0dd062ff985fc4819eb11c294b34f763c2e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML classifier also flagged this PDF as malicious. The embedded URLs suggest a link farm or SEO manipulation tactic, potentially to distribute further malicious content or to inflate search engine rankings for malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rootedwithyou.com/uploads/1/3/0/7/130775354/130775354.html#livro+a+bolsa+amarela+para+baixar
    • http://tallitministries.org/uploads/1/3/0/7/130776781/somowi.pdf
    • http://k-pages.de/uploads/1/3/1/4/131454383/2432869.pdf
    • http://fluturefrumos.com/uploads/1/3/0/8/130873984/kobalejutowezeruxa.pdf
    • http://theneuralist.com/uploads/1/3/1/4/131483525/lapax.pdf
    • http://winkfashionandsalon.com/uploads/1/3/1/8/131856119/6274557.pdf
    • http://cgcgroupinc.com/uploads/1/3/0/9/130969681/sabivu_ziwugejug_gidugi_gugebum.pdf
    • http://donnamalonescience.com/uploads/1/3/0/6/130604151/7782736.pdf
    • http://stefaniefusi.com/uploads/1/3/0/4/130476086/fudisiso_lajeze_subovetepure_wejowutex.pdf
    • http://mallamustv.com/uploads/1/3/1/8/131856347/bisidesuxis_derakapejefe_zedidibudus_jaxapine.pdf
    • http://milwaukeetoireland.com/uploads/1/3/1/8/131857204/0a53f.pdf
    • http://homesoldbysunday.com/uploads/1/3/0/4/130483527/5c54aefe.pdf
    • http://zebrerenovation.com/uploads/1/3/0/4/130436521/4a745b98d.pdf
    • http://edknee.com/uploads/1/3/0/2/130270761/1378858.pdf
    • http://matthew-zimmer.com/uploads/1/3/0/8/130813777/pinafitupu.pdf
    • http://kristawoelk.com/uploads/1/3/1/3/131379434/7752182.pdf
    • http://airforce-aviation.com/uploads/1/3/0/5/130551073/tutikoligepobi.pdf
    • http://spectrumherniaclinic.com/uploads/1/3/1/6/131606807/805070.pdf
    • http://travelmadeeasy.biz/uploads/1/3/0/7/130776864/9893573.pdf
    • http://careercomp.net/uploads/1/3/0/3/130323295/nidojezajamama.pdf
    • http://diabetx.net/uploads/1/3/1/1/131164273/mugariribaw.pdf
    • http://cozycraftyboutique.com/uploads/1/3/0/5/130540799/fenolan.pdf
    • http://firstdelightphotography.com/uploads/1/3/0/5/130544872/wokobade-xaremebovijalug.pdf
    • http://watermandigitalcinema.com/uploads/1/3/1/4/131483361/lomuv.pdf
    • http://businessfurniturecleaning.com/uploads/1/3/0/6/130605275/6f798095b3cd2a4.pdf
    • http://mayflyappraisals.com/uploads/1/3/0/3/130379367/dce15.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062a7.bin
b2cca8ccdaff049211059063a060f74fc72e7e360a8502ba69ea61ca9364e3e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62A7 14780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.