Malicious PDF — malware analysis report

Static analysis result for SHA-256 72926ef4f847dc01…

MALICIOUS

PDF

41.2 KB Created: 2020-03-15 09:51:48 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ac7eb2d8d543e22c08df795359455bdf SHA-1: 40b9b0cd50f4b863d2288799f2d11d7f042588a5 SHA-256: 72926ef4f847dc01ebc8acb07c060f39583a8bc30e0b917bb61913229bed1493
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a reference to 'http://thefivemilliondollarbook.stefanaarnio.com/uploads/1/3/0/5/130588529/130588529.html#google+sheets+count+if+unique', which is also listed as an embedded URL. This suggests a campaign to drive traffic to numerous external PDF files, potentially for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thefivemilliondollarbook.stefanaarnio.com/uploads/1/3/0/5/130588529/130588529.html#google+sheets+count+if+unique
    • http://gospelgraceslc.com/uploads/1/3/0/7/130776027/tubofugonokuram_ponirujovepa_xigagorenuw_wijosaroguxero.pdf
    • http://nurturezone.co.za/uploads/1/3/0/5/130540645/kusowuvodenesawenoba.pdf
    • http://nutrition-doctor.co.uk/uploads/1/3/0/5/130588588/7577923.pdf
    • http://taptep.com/uploads/1/3/0/4/130476180/e3bf4a.pdf
    • http://parvathyprem.com/uploads/1/3/0/8/130813533/konezugilixuxozuma.pdf
    • http://radoynovska.com/uploads/1/3/0/5/130588644/6980150.pdf
    • http://linusheusden.be/uploads/1/3/0/3/130379408/ea2efbf74b790d.pdf
    • http://oilfeildclothing.com/uploads/1/3/0/6/130603803/1557222.pdf
    • http://4rkids4rfuture.net/uploads/1/3/0/3/130379333/kiforurazigigoselaro.pdf
    • http://eqtna.com/uploads/1/3/0/4/130476607/307636.pdf
    • http://ballisticsusa.org/uploads/1/3/0/2/130273762/c359397c1d.pdf
    • http://sahirsharma.com/uploads/1/3/0/7/130776122/eba8e.pdf
    • http://splinteredmindapparel.com/uploads/1/3/0/7/130739836/88b97da7927.pdf
    • http://www.marinalavrova.com/uploads/1/3/0/6/130639083/4449cc8ca95.pdf
    • http://fairvotemn.com/uploads/1/3/0/2/130288430/f4b11493f38.pdf
    • http://www.getfitwithjayy.com/uploads/1/3/0/9/130969876/paruludur.pdf
    • http://looe-festival-of-the-sea.com/uploads/1/3/0/6/130620657/9514950.pdf
    • http://ekataloglar.com/uploads/1/3/0/6/130621393/zujafosegubokujezim.pdf
    • http://mipiacitu-polgio.com/uploads/1/3/0/6/130620782/saligu.pdf
    • http://ns1.katrinaconnolly.com/uploads/1/3/0/6/130604805/1900750.pdf
    • http://www.damamedicine.org/uploads/1/3/0/6/130620483/vasuropelapoxe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007692.bin
c469d4fc86b4901e41a287f8cd606611e60720e88faae78c7bba31ac63e0dae8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7692 8592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.