Malicious PDF — malware analysis report

Static analysis result for SHA-256 72b6cae799339a26…

MALICIOUS

PDF

43.8 KB Created: 2020-04-07 16:13:06 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 02b423af71e643fe05ec9d31b6679344 SHA-1: 3524799d9283589c48adc1ff0ca5b5ca05f4b706 SHA-256: 72b6cae799339a267bf1074d00dcc78806e6838f6571d2d58898fa0e62948deb
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML classifier also strongly flagged this PDF as malicious. The document body, though partially corrupted, contains a title related to solving quadratic inequalities and references the wkhtmltopdf tool, indicating it may be a lure to disguise the malicious intent of directing users to potentially harmful external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://acouturelife.com/uploads/1/3/0/7/130740045/130740045.html#como+resolver+inecuaciones+de+segundo+grado+con+dos+incognitas
    • http://themileycollectiononline.com/uploads/1/3/0/6/130621361/57de29cbc59b5ca.pdf
    • http://linseyhampton.com/uploads/1/3/0/4/130489229/c85870e9ed.pdf
    • http://megcraigphotography.com/uploads/1/3/1/4/131483550/xufezapiru-vevezase.pdf
    • http://inktaiwan.com/uploads/1/3/1/4/131410872/dedb82.pdf
    • http://punkrockdeals.com/uploads/1/3/0/3/130323335/fafa2e.pdf
    • http://iamsarahneill.com/uploads/1/3/0/4/130476940/9727019.pdf
    • http://sonyagoins.pink/uploads/1/3/0/6/130620341/3917772.pdf
    • http://goalsuniversal.org/uploads/1/3/0/7/130740177/xalepaje_gofopafupajaki_zujefib.pdf
    • http://polarcapcompany.com/uploads/1/3/0/4/130488565/3757076.pdf
    • http://citydeskstudios.com/uploads/1/3/1/3/131381693/wiketobadukisomew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e06.bin
8a71f14b3fbd4df6b90ccb693a5ecc062910700fb1acd5aba755e77cd607928f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E06 9468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.