Malicious PDF — malware analysis report

Static analysis result for SHA-256 79229fd87eb83fbf…

MALICIOUS

PDF

43.5 KB Created: 2020-06-13 14:10:38 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-24
MD5: e5959dde719acb25cb1f34eebeb41240 SHA-1: 5d99028d99a6d3af02009e73ff7799a844586c86 SHA-256: 79229fd87eb83fbf7e5934b8d31c552c7e1df22ab3540eb95ec49bdbb5a26993
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a potential link farm, suggesting the document's primary purpose is to drive traffic to these external resources. The embedded URLs and the ML classifier strongly indicate malicious intent, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pulque.com/uploads/1/3/1/1/131164174/131164174.html#kosgeb+i%25C5%259F+plan%25C4%25B1+%25C3%25B6rne%25C4%259Fi+word+2015 PDF link annotation
    • http://shawinsurancerealty.com/uploads/1/3/1/4/131453450/07d4fd02e1.pdfIn PDF document text
    • http://office.seasholmen.org/uploads/1/3/0/5/130547150/5798358.pdfIn PDF document text
    • http://premiumdetailingco.com/uploads/1/3/0/9/130968935/sewezim.pdfIn PDF document text
    • http://778.bpmtc.com/uploads/1/3/1/3/131380065/954577.pdfIn PDF document text
    • http://equinemassageschool.com/uploads/1/3/1/3/131398117/51007fd3488.pdfIn PDF document text
    • http://cpcontacts.fairwaymemorial.com/uploads/1/3/0/5/130546457/dejetimezevigog-jifif-sawixawojuwi-puguguzaruj.pdfIn PDF document text
    • http://mta-sts.tracymedeiros.com/uploads/1/3/1/3/131383332/ca81b009.pdfIn PDF document text
    • http://autoaccidentlawyerswtl.com/uploads/1/3/0/6/130622077/6568137.pdfIn PDF document text
    • http://vildro.com/uploads/1/3/0/8/130813635/3892217.pdfIn PDF document text
    • http://katskornerinternational.org/uploads/1/3/1/4/131438202/razonegupel_boriz.pdfIn PDF document text
    • http://hhehenryhamerenterprises.com/uploads/1/3/0/2/130289696/bibeme_pamipopav_wawijiti_zegupenisur.pdfIn PDF document text
    • http://cpanel.lynn-gustafson.com/uploads/1/3/0/3/130323733/bowanegod.pdfIn PDF document text
    • http://aznaysacbd.com/uploads/1/2/9/4/129426716/129426716.html?obraIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://kawebori.files.wordpress.com/2020/06/18648530557.pdfIn PDF document text
    • https://ziradodenu.files.wordpress.com/2020/06/lemugirasumefanojomimof.pdfIn PDF document text
    • https://sexepik.files.wordpress.com/2020/06/lenotezuva.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065eb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x65EB 11604 bytes
SHA-256: 09b8348e7c2db1d2c2e4d3171914eea114202f23761d6f8e8ac73ebaa9beae4f
font_01_sfnt_off00008a26.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8A26 16312 bytes
SHA-256: 028dbaa76d48ae99b02248bacea50134e27ed131f5dd39e25ac401de8961e19b

Open this report in the interactive analyzer, or submit your own file for analysis.