Malicious PDF — malware analysis report

Static analysis result for SHA-256 77fe23ce832f7888…

MALICIOUS

PDF

48.3 KB Created: 2020-03-29 13:24:22 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e3ff5f5e49dabe4c315e74ea63227143 SHA-1: 11f55e4e714b61d203a452fdd5531b7a6cb5b135 SHA-256: 77fe23ce832f7888c8af0666d424f31085f1d42628a6e80ad61e88bb79d31572
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO manipulation tactic. The ML classifier also strongly indicated maliciousness. The document body text is largely obfuscated, but the presence of numerous URLs indicates an attempt to redirect the user to external resources, potentially for further exploitation or malicious content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seastar.websalve.com/uploads/1/3/0/8/130874183/130874183.html#diferencia+entre+monosacaridos+oligosacaridos+y+polisacaridos
    • http://jowithplants.com/uploads/1/3/0/2/130270918/809a49e619be99e.pdf
    • http://theartorder.net/uploads/1/3/1/0/131070973/5710510.pdf
    • http://mywelltrek.com/uploads/1/3/0/2/130289498/sodob_vuvobotiboga_vazijamateduji_xokarezig.pdf
    • http://northchannelnetwork.org/uploads/1/3/0/8/130813429/tigeluz.pdf
    • http://thecartoonboon.com/uploads/1/3/0/6/130640020/noluwibubu.pdf
    • http://idreamworld.us/uploads/1/3/1/4/131411078/9468898.pdf
    • http://ristorantealtamareasorso.com/uploads/1/3/0/6/130604110/2431502.pdf
    • http://ottawasmortgagebroker.ca/uploads/1/3/0/8/130814462/fipimivazujet.pdf
    • http://steamboattees.com/uploads/1/3/0/4/130494478/zopelaxego-jupalanu-geremakujerufa-wusuk.pdf
    • http://luxuryseniortravels.com/uploads/1/3/1/3/131380848/826142.pdf
    • http://idovideophoto.com/uploads/1/3/0/2/130291766/kokuv-fafezeselokuja-werebediba.pdf
    • http://karverkraft.com/uploads/1/3/0/7/130775334/vagugelexu.pdf
    • http://wacommercialappliances.net/uploads/1/3/0/4/130489417/givapukibetajoro.pdf
    • http://rdcdesigns.org/uploads/1/3/0/6/130621544/guwokimewizifunumus.pdf
    • http://empresadeservicios.net/uploads/1/3/0/3/130313177/boboxusibigaratofeju.pdf
    • http://addycakescookies.com/uploads/1/3/0/4/130483923/84196857b822.pdf
    • http://takemeofflist.org/uploads/1/3/0/9/130969170/sejelikugo.pdf
    • http://dk44consulting.com/uploads/1/3/1/4/131406950/9ff5c21.pdf
    • http://michaelphagen.com/uploads/1/3/0/7/130739280/96fa113bd7.pdf
    • http://luckylovebamboos.com/uploads/1/3/1/4/131406892/nagenuwuvuw.pdf
    • http://eccentricsoundz.com/uploads/1/3/0/6/130639374/2332350.pdf
    • http://chefgustavopr.com/uploads/1/3/0/7/130776514/7e372c744004.pdf
    • http://groupbeans.com/uploads/1/3/0/7/130739463/431d309b3104c3.pdf
    • http://inismotorsport.com/uploads/1/3/1/1/131163841/fecb9c921982.pdf
    • http://stableconnections.ca/uploads/1/3/0/6/130621597/lezixikoxad.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079d9.bin
bf28fd4722a73227045eb86460810e30a612e3c3a4b6d2cecd0ff4913182990a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79D9 8264 bytes
font_01_sfnt_off000097e6.bin
885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x97E6 4144 bytes
font_02_sfnt_off0000a4df.bin
c048ac4ed90d63bfae46472f65f9cf6fc0bd5e75369f2d8f28771a6d96a2731c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA4DF 3156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.