Malicious PDF — malware analysis report

Static analysis result for SHA-256 78f2406b24d130c3…

MALICIOUS

PDF

39.3 KB Created: 2020-03-23 12:22:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: 895e35bc776b63e83566d5771dd9fa75 SHA-1: cde2cbf83cb1c92efba58ca99deb2229416f77da SHA-256: 78f2406b24d130c3aad5b44f510aa7e4e3c88b454dcdc38614baefeb3dad26fa
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links, many of which are structured as numeric slugs pointing to PDF files, indicating a link farm for SEO manipulation or malware distribution. The ML classifier strongly flagged this PDF as malicious. The embedded content suggests a lure related to educational worksheets, which is a common tactic for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michaelwellsart.com/uploads/1/3/0/4/130436337/130436337.html#unit+2+solving+equations+and+inequalities+worksheet+answers PDF link annotation
    • http://hostmaster.therecoveryfestival.co.uk/uploads/1/3/0/3/130323207/gusubogewosojug.pdfIn PDF document text
    • http://goodbyetorenting.com/uploads/1/3/0/3/130379297/c3e379.pdfIn PDF document text
    • http://braizinmuebles.com/uploads/1/3/0/8/130874526/rajajiwujame.pdfIn PDF document text
    • http://nietojewelry.com/uploads/1/3/0/5/130588799/vavapumupajebu_kulib.pdfIn PDF document text
    • http://hostmaster.jeroenvandijken.eu/uploads/1/3/0/2/130289256/cd5db65e7cd.pdfIn PDF document text
    • http://bunburymarriage.com/uploads/1/3/0/5/130588463/2721549.pdfIn PDF document text
    • http://kunzeartgallery.com/uploads/1/3/0/3/130379138/sagavofipux.pdfIn PDF document text
    • http://www.dadevilledixieyouth.com/uploads/1/3/0/6/130604388/tidoweziwiwojajiluji.pdfIn PDF document text
    • http://courtneysteed.com/uploads/1/3/0/6/130605490/3715523.pdfIn PDF document text
    • http://sheimdal.com/uploads/1/3/0/8/130813079/pusulobix.pdfIn PDF document text
    • http://littledragonsrugby.org/uploads/1/3/0/5/130550827/5690d624c.pdfIn PDF document text
    • http://globalpart.info/uploads/1/3/0/7/130740572/xafewot.pdfIn PDF document text
    • http://golfscoutapp.com/uploads/1/3/0/6/130604729/nanizetebolufot_pevoketeben_puxenolo.pdfIn PDF document text
    • http://mercedjet.com/uploads/1/3/0/7/130740480/koveminarok.pdfIn PDF document text
    • http://m.namiracine.org/uploads/1/3/0/7/130740210/padipirima.pdfIn PDF document text
    • http://traicay123.com/uploads/1/3/1/1/131163864/menitabipekilul-dutagav.pdfIn PDF document text
    • http://soloinsurancequotes.com/uploads/1/3/0/9/130969879/1d0ac37f69fb.pdfIn PDF document text
    • http://thefiprofessor.com/uploads/1/3/0/5/130551339/4345795.pdfIn PDF document text
    • http://tomwenfashiondesign.com/uploads/1/3/0/5/130590361/4ac7c8.pdfIn PDF document text
    • http://teatrforte.pl/uploads/1/3/0/2/130288363/2996909.pdfIn PDF document text
    • http://carroattrezziusati.com/uploads/1/3/0/6/130621451/732375a30c6d56.pdfIn PDF document text
    • http://firstaid4life.net/uploads/1/3/0/5/130542972/4400520.pdfIn PDF document text
    • http://www.anywound.com/uploads/1/3/0/6/130603725/5530947.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006edf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6EDF 7800 bytes
SHA-256: d00f536adb082af8b3330d1f53c3418a0de9aa1101b42743629ef7a21996e54c

Open this report in the interactive analyzer, or submit your own file for analysis.