PDF malware analysis — malicious · 77ff874830893538

MALICIOUS

PDF

38.1 KB Created: 2020-03-20 02:06:29 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: cf8786ce2a2383726b79c5ed0277f35c SHA-1: b9282a09292f180f0a0628e3c1d84d0426cf29c4 SHA-256: 77ff874830893538a3eaa343ea596b215a4d0b65a1f035cddd3e113ec0cc11d9

96 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for further malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://bpmusiceditions.com/uploads/1/3/0/4/130475881/130475881.html#university+of+chicago+classics+department
- http://www.mickeyandminis.net/uploads/1/3/0/6/130640088/4807264.pdf
- http://xn--mnnerdit-0zag.com/uploads/1/3/0/6/130639521/dekapofigu.pdf
- http://empoweringcitizens.org/uploads/1/3/0/2/130287934/566f29dc925846b.pdf
- http://here2organize.com/uploads/1/3/1/1/131164573/8749610.pdf
- http://primeclassutah.com/uploads/1/3/0/2/130272606/499cbb2.pdf
- http://ctbfresh.com/uploads/1/3/0/2/130273623/xalefuwojaledud_jolomaserebove.pdf
- http://photography-classes-tours.com/uploads/1/3/1/0/131070071/rusevadukasiti.pdf
- http://www.starsandimagination.com/uploads/1/3/0/3/130313108/likedorikuvisa_fuburogixibazu_watidigaxunovo.pdf
- http://dualtutors.com/uploads/1/3/0/8/130873995/pakudazo.pdf
- http://www.ozeron.com/uploads/1/3/0/4/130479472/waseselefinusetesudu.pdf
- http://cpanel.indigoeventservices.com/uploads/1/3/0/5/130541803/laxakefe.pdf
- http://balonprocess.com/uploads/1/3/0/6/130622106/kekibuzuwo.pdf
- http://hostmaster.bathgatewayoutandabout.co.uk/uploads/1/3/0/5/130539329/663789.pdf
- http://stormbroker.net/uploads/1/3/0/4/130476984/dipujaz.pdf
- http://mail.synchealthfit.net/uploads/1/3/0/5/130589252/mesodep.pdf
- http://www.myentouragemusic.com/uploads/1/3/0/6/130605462/zopisukosowaf.pdf
- http://epcfootball.com/uploads/1/3/0/3/130323620/subukavu.pdf
- http://poseidonpowerkft.com/uploads/1/3/0/6/130605476/jebumivokazi.pdf
- http://hostmaster.mackplumbing.com/uploads/1/3/0/2/130289573/fikofuxivupe.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006ca4.bin` `7d9a42feb93425fdf7603389e73301a85ac1d5f8da0770222c7921613fd50c83`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6CA4	7296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.