Malicious PDF — malware analysis report

Static analysis result for SHA-256 71d8c34af77ef547…

MALICIOUS

PDF

119.9 KB Created: 2020-06-05 17:10:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 69f559ba51585f7a585df16d9b9ca6cb SHA-1: 0ce35f116fbfa3df588693400899cddc3ffbacca SHA-256: 71d8c34af77ef5470dae630f7639796e821f945692b497094e992304e68d0d3d
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was identified as malicious by an ML classifier and contains a large number of external links, many pointing to other PDF files. The document body contains text related to 'Pony waifu sim names' and the wkhtmltopdf application, suggesting a potential lure or distraction. The primary attack pattern observed is the creation of a link farm, likely for SEO manipulation or to distribute further malicious content, indicated by the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dogknows.net/uploads/1/3/1/3/131379965/131379965.html#pony+waifu+sim+names
    • http://the-villas-solana-beach.com/uploads/1/3/0/3/130313445/fisabux.pdf
    • http://nhc-ltd.com/uploads/1/3/1/8/131856314/4989083.pdf
    • http://thebrucken.com/uploads/1/3/0/6/130639228/wumijurajor-derogirevogozes-wokeg-mijameji.pdf
    • http://sam.gestaltsam.ch/uploads/1/3/0/7/130739532/97bfbc79d68fd1.pdf
    • http://power2thewomb.com/uploads/1/3/1/6/131606057/8172525.pdf
    • http://thetucsonroofingcontractor.com/uploads/1/3/0/6/130620389/018c6.pdf
    • http://dogknows.net/uploads/1/3/1/3/131379965/terms.html
    • http://dogknows.net/uploads/1/3/1/3/131379965/dmca.html
    • http://dogknows.net/uploads/1/3/1/3/131379965/policy.html
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://gaminoniw.files.wordpress.com/2020/06/mamimulafugarutelaziwuwex.pdf
    • https://bezifunija.files.wordpress.com/2020/06/87959004228.pdf
    • https://vixudapojez.files.wordpress.com/2020/06/2980116512.pdf
    • https://xupunugoj.files.wordpress.com/2020/06/jofezekufedo.pdf
    • https://gusabuj.files.wordpress.com/2020/06/2474048095.pdf
    • https://wofodoxukej.files.wordpress.com/2020/06/46715885279.pdf
    • https://bikaluvamu.files.wordpress.com/2020/06/31661179635.pdf
    • https://zizixabaga.files.wordpress.com/2020/06/segiwamuliganoromufugi.pdf
    • https://fusewolaj.files.wordpress.com/2020/06/71533915943.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://scripts.sil.org/OFL
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00018aee.bin
8085e85f7ab2ec424f2d1e8603e5adaf13eeac0702cda241d6a7218dd8b8c71c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18AEE 2484 bytes
font_01_sfnt_off0001958f.bin
dd2b70d0d971452256a4f441fd906570ba3e8eb49b2e1f9fe8e1a1b1a5914818		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1958F 11740 bytes
font_02_sfnt_off0001bdcb.bin
c7fc2d1081ce2d1179ed2afaf5a23d9e8d82a48aaeac8228758ce014c49ce151		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1BDCB 16072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.