Malicious PDF — malware analysis report

Static analysis result for SHA-256 784006dc37ad482d…

MALICIOUS

PDF

42.7 KB Created: 2020-03-27 09:37:33 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7157a059cf19cdc60a6eca5fef4f28aa SHA-1: fa63a2e24274d4511f92572959f0a0ad01826c28 SHA-256: 784006dc37ad482d069841fbf24d40d33bb313812adff4c487933fdd79225995
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO spamming operation. The embedded links, such as http://mrstruitt.com/uploads/1/3/0/5/130590689/130590689.html#el+poder+de+tu+amor+ricardo+montaner+acordes, likely serve to redirect users to potentially malicious websites or to artificially inflate search engine rankings. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrstruitt.com/uploads/1/3/0/5/130590689/130590689.html#el+poder+de+tu+amor+ricardo+montaner+acordes
    • http://maratonadeprogramacao.com/uploads/1/3/0/2/130291572/4172268.pdf
    • http://solesurvivorstraining.com/uploads/1/3/1/0/131070526/6017574.pdf
    • http://x0418438xstreamtravel.xsideas.com/uploads/1/3/0/5/130539344/0b8ed34ff84df1.pdf
    • http://freshstartcleaningsystems.com/uploads/1/3/0/5/130538990/pidibumoxogen-lidugepidabifu-sogegobe-pikewu.pdf
    • http://www.vtmountainlove.com/uploads/1/3/0/4/130435986/7808539.pdf
    • http://componentcatalog.dev/uploads/1/3/0/7/130739073/7302301.pdf
    • http://collabor8ivestudio.com/uploads/1/3/0/2/130270775/021cdb9e.pdf
    • http://moulin-de-lene.com/uploads/1/3/0/4/130483492/8c02d4a60.pdf
    • http://comotv.net/uploads/1/3/0/5/130590672/vudojune.pdf
    • http://oldbeatniksautos.com/uploads/1/3/1/0/131070116/xazuropemogak_fekameji_totonoroxeze_pugoterinope.pdf
    • http://qurxintagurayaha.com/uploads/1/3/0/4/130483745/lizinejurixo_govap_kutekubokivaber_poseluvekarez.pdf
    • http://poljerequip.ca/uploads/1/3/0/2/130289305/1429030.pdf
    • http://290pleasantstu313.com/uploads/1/3/0/6/130639805/nizolovori-bumapagemobe-xojaveluz.pdf
    • http://thebibleistheanswer.org/uploads/1/3/0/2/130271229/xinuruxagifemefej.pdf
    • http://lanerealestateservices.com/uploads/1/3/0/6/130604948/5620904.pdf
    • http://waconda.com/uploads/1/3/0/5/130588625/739222.pdf
    • http://boccesubscription.com/uploads/1/3/0/6/130639272/budovala.pdf
    • http://www.thedevilboresme.com/uploads/1/3/0/6/130639774/294a96b445.pdf
    • http://internationaldunnage-us.net/uploads/1/3/0/6/130621815/9064694.pdf
    • http://emersonclarey.com/uploads/1/3/0/5/130540186/xibebawe-nivijekatoto.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007c53.bin
b757b6d669975da3fedf4b3a0ef5bce49f973212aec6d44fec0bf124a6d07b9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C53 8308 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.