Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b10605c7e66127c…

MALICIOUS

PDF

55.6 KB Created: 2020-03-29 10:51:28 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5db3c1e100149eb7fb1a52ca35564b04 SHA-1: 375eb0d8ea9e3351bcb29815e1b81f33792be91b SHA-256: 7b10605c7e66127cb577890863be5562cd8eb45278792b66ce9e063014b278ce
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of embedded external links pointing to various domains, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The primary purpose appears to be directing users to a vast network of linked content, potentially for SEO spam or to serve as a distribution point for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://misssoutheastpageantry.us/uploads/1/3/1/4/131438055/131438055.html#lydia+e+hall+nursing+theory
    • http://beacloudaccounting.guru/uploads/1/3/0/7/130775402/2099320.pdf
    • http://adorableuplustoo.com/uploads/1/3/0/4/130436458/7667025.pdf
    • http://www.fernandezsocialservicespdx.com/uploads/1/3/0/2/130287527/3504036.pdf
    • http://massonconstructionltd.uk/uploads/1/3/0/5/130546742/4fec1090540aa.pdf
    • http://www.bvmeuc.com/uploads/1/3/1/0/131070387/vamidadoxowono.pdf
    • http://maidforperfectionllc.com/uploads/1/3/0/9/130969553/4408758.pdf
    • http://mta-sts.mx.thepetalpatch.com/uploads/1/3/0/7/130775982/b34451a97498d1.pdf
    • http://easy-firmware.site/uploads/1/3/1/1/131164266/vejefanunupig_tegid.pdf
    • http://brightwolfdoge.us/uploads/1/3/0/3/130312983/ririwegabiku.pdf
    • http://juntamugre.net/uploads/1/3/0/8/130814805/xibofojipanalu-jetobarogumor-rakom-rerag.pdf
    • http://keeganendeavor.com/uploads/1/3/0/6/130639889/ec8bebc0e590c8.pdf
    • http://shaydanielleesthetics.com/uploads/1/3/0/3/130313161/6441e1ee9e3c.pdf
    • http://fundamenton.com/uploads/1/3/0/6/130604332/bofosexuwi.pdf
    • http://ilfiloderbapsicomotricita.com/uploads/1/3/0/5/130588239/1375e2f2e8e90.pdf
    • http://asmall.shop/uploads/1/3/0/8/130874086/4f17d0e0d53eec9.pdf
    • http://mrlowescience.net/uploads/1/3/0/7/130738700/najiguk.pdf
    • http://whitefirephoto.com/uploads/1/3/0/4/130483354/rajiso_tuxopuz_furopopogev.pdf
    • http://pamelagallagher.com/uploads/1/3/0/4/130488631/7998587.pdf
    • http://lobaventures.com/uploads/1/3/0/7/130740202/77156403f.pdf
    • http://parameterdrivensolutions.com/uploads/1/3/0/5/130589320/lonexesibakam_juwifizo.pdf
    • http://www.gr8kidzactionsports.com/uploads/1/3/0/5/130547286/zirawinixurofip.pdf
    • http://kamilasbeautyroom.com/uploads/1/3/0/3/130313434/7855259.pdf
    • http://concreteprosci.com/uploads/1/3/0/6/130639860/1372830.pdf
    • http://listenupmedia.net/uploads/1/3/0/5/130544547/7ec3819a999873.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b0d7.bin
3ff02258a29d80fe83734d1b7c20d299891fd015fefc3adab55a6fc45d9aa879		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB0D7 8124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.