Malicious PDF — malware analysis report

Static analysis result for SHA-256 7324ed69572c6c61…

MALICIOUS

PDF

49.1 KB Created: 2020-03-30 03:43:32 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bcd0e8f05c4690085ed889c29ee0c2b3 SHA-1: 02b998e719515549bb1b8f792ba89905bd765341 SHA-256: 7324ed69572c6c6157b5d247b8f717285450f11ed467e82a622a2bd506f3e3a6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file exhibits characteristics of a link farm or SEO spam, containing numerous external links to other PDF documents hosted on various domains. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic identified a mass of external links. The embedded URLs likely serve to direct users to potentially malicious content or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sweetestdreams.org/uploads/1/3/0/7/130740412/130740412.html#permutacion+y+combinacion+estadistica
    • http://myimaze.com/uploads/1/3/0/6/130604050/mepevikezipikibabab.pdf
    • http://theskyeiman.co/uploads/1/3/0/6/130620679/2950073.pdf
    • http://groomsbyjagger.com/uploads/1/3/0/4/130475965/gezalutalebobud.pdf
    • http://coquiiloveyou.net/uploads/1/3/0/7/130775800/3955317.pdf
    • http://uec.la/uploads/1/3/0/3/130313388/2133867.pdf
    • http://castleonchurch.com/uploads/1/3/1/4/131438304/c32ead3.pdf
    • http://weartwocamps.com/uploads/1/3/0/7/130776716/bofagisi-bivafodura.pdf
    • http://ericcadette.com/uploads/1/3/0/7/130775217/5862263.pdf
    • http://emiliefoy.com/uploads/1/3/0/7/130739535/jebuborow-zinefefitis-mebasikepen.pdf
    • http://mlvehiclemaintenance.com/uploads/1/3/0/4/130436007/xipirebixodifew.pdf
    • http://decrisis.org/uploads/1/3/0/7/130775665/kelagotozalexutosep.pdf
    • http://milkinow.com/uploads/1/3/0/6/130603827/11c421.pdf
    • http://marianails.net/uploads/1/3/0/4/130478163/welazaziruwin.pdf
    • http://nicole-florio.com/uploads/1/3/0/5/130550982/nivuzuwuvububufuvum.pdf
    • http://kendramarshall.com/uploads/1/3/0/6/130604606/9052492.pdf
    • http://systematicsweepers.com/uploads/1/3/0/8/130814711/tositubinixa_bikeb.pdf
    • http://julesbartling.com/uploads/1/3/0/4/130483678/reguwakixoku_lepivakipodanir_robukazizemokuf_nagugakavutis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000930f.bin
c783ad766b73e5b5896a26cf4a13c074bffff945e1b7597e3f2cbc5feca1756b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x930F 9468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.