Malicious PDF — malware analysis report

Static analysis result for SHA-256 76df87c2485f4de5…

MALICIOUS

PDF

46.6 KB Created: 2020-04-03 06:45:44 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c790b801f82686e2be18a9b053769993 SHA-1: 487844c6db759bebf2eb68843d84973cccae7991 SHA-256: 76df87c2485f4de5a473c040b5bd6c92519305dc34724d25ccfd6d93ddb44c88
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, identified as a link farm, which is a common tactic for SEO manipulation or distributing malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs further supports a malicious intent. No scripts were extracted, but the sheer volume of outbound links suggests a coordinated effort to direct users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://harperalsnowden.com/uploads/1/3/0/5/130589098/130589098.html#strategic+innovation+management+exeter
    • http://ddchealth.org/uploads/1/3/1/4/131406109/5470643.pdf
    • http://continentalgift.com/uploads/1/3/0/7/130740178/5b0810e9fb85e.pdf
    • http://keynesadvisor.com/uploads/1/3/0/7/130775747/tojepipifiwoxu.pdf
    • http://directcarenepal.org/uploads/1/3/0/8/130873869/puvuxijizona.pdf
    • http://knkiapp.com/uploads/1/3/1/4/131406963/7394038.pdf
    • http://cassidyhalpin.com/uploads/1/3/1/0/131070733/1995451.pdf
    • http://duduredpalatefoodbekeryinc.com/uploads/1/3/0/9/130969874/2348830.pdf
    • http://jetinspectionsllc.com/uploads/1/3/0/6/130605069/2363957.pdf
    • http://hilltopexcavation.com/uploads/1/3/0/4/130476012/pejisaza.pdf
    • http://carrickbbqcatering.com/uploads/1/3/1/3/131398214/jafitiwodoreja.pdf
    • http://freshjuicejoint.com/uploads/1/3/0/4/130483869/609842.pdf
    • http://diamant-trauringe-hochzeit.de/uploads/1/3/0/3/130323341/981afa8326a70a.pdf
    • http://transformingliveschurch.org/uploads/1/3/0/7/130775554/2532276.pdf
    • http://thedgline.com/uploads/1/3/0/9/130969045/nunat_fedinedikuwarok_dasufenenokiti.pdf
    • http://humboldtholisticfoundation.com/uploads/1/3/0/2/130273804/kuradijejafeliv-jiwizus.pdf
    • http://coastaleducationservices.net/uploads/1/3/0/8/130814401/wakizenewuwolulu.pdf
    • http://cinderellacares.com/uploads/1/3/0/5/130590169/zadumuwelod-ganide.pdf
    • http://fairoakssmogtest.com/uploads/1/3/0/5/130540795/guferuvuj.pdf
    • http://dillonhunterforpresident.com/uploads/1/3/1/3/131383541/8321941.pdf
    • http://cejaspostizas.com/uploads/1/3/1/0/131070356/nozulojikiluzivanevi.pdf
    • http://theultimatecruiser.com/uploads/1/3/0/7/130738647/d12cb4ef.pdf
    • http://iamfree2b.net/uploads/1/3/1/4/131406269/mijexixugozu-sapimigewix.pdf
    • http://caringadvisors.com/uploads/1/3/0/5/130542775/xowagezojulejisegu.pdf
    • http://concretedecorativesolutions.com/uploads/1/3/0/3/130323291/949b63e5eb080ac.pdf
    • http://easyfootcare.com/uploads/1/3/0/7/130739039/7728474.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008cd7.bin
f042f492429cbcf1fcb36bf770ced23429e65131a504197e1aa1e6fa2cffe442		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8CD7 8176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.