Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d70e69f59b06a4c…

MALICIOUS

PDF

58.0 KB Created: 2020-03-17 16:18:24 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9644e5518d77feca92c74537a452d9a8 SHA-1: f17c72c1c86febea6fe265e8c9c44b5aa6aaea07 SHA-256: 7d70e69f59b06a4c3d8953055d509b7b8e51dee01db7b63356d6d6fbdfbc9c93
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous external links, identified as a link farm, suggesting a tactic to manipulate search engine rankings or distribute malicious content. The ML classifier strongly flagged this PDF as malicious, and the presence of embedded URLs and a 'download' lure reinforces the malicious intent. While no scripts were directly extracted, the PDF structure and link farm heuristic indicate a high likelihood of directing users to harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whyagileteamsfail.com/uploads/1/3/0/2/130272955/130272955.html#jimmy+cornell+world+cruising+routes+pdf+download
    • http://www.itsawrapproductions.eu/uploads/1/3/0/8/130813948/95848.pdf
    • http://nativeitaliano.com/uploads/1/3/0/7/130739396/bofokugipume.pdf
    • http://teeandcarol.com/uploads/1/3/0/5/130589452/4327243.pdf
    • http://mieldercarelaw.com/uploads/1/3/0/5/130588575/gojejuzulisemiko.pdf
    • http://judicalis.org/uploads/1/3/0/4/130488387/463815.pdf
    • http://nogginblock.net/uploads/1/3/0/6/130621228/funewodi_bazusasatamejix.pdf
    • http://www.lindseyhemmings.co.uk/uploads/1/3/1/1/131163984/zilegopenesomikane.pdf
    • http://prosperitylawcenter.com/uploads/1/3/0/7/130739564/1a78e29aeee7.pdf
    • http://pinweiwong.com/uploads/1/3/0/6/130621143/kobikurexup.pdf
    • http://squeakyqueens.net/uploads/1/3/0/7/130775665/7761397306.pdf
    • http://www.ninthvision.com/uploads/1/3/0/6/130604597/sosakefukoli-gujis-dopisigokemiwub-rugarowe.pdf
    • http://j3supply.com/uploads/1/3/0/5/130589158/lupusopimuxef-bubamefadebaxuz.pdf
    • http://watchwashr.com/uploads/1/3/0/6/130604306/1008138.pdf
    • http://www.rockymountainpaintingcompany.com/uploads/1/3/0/6/130604833/9059787.pdf
    • http://www.zriiaustralia.com/uploads/1/3/0/7/130775261/mevogekefofuniji.pdf
    • http://mail.crosscountrycleaners.org/uploads/1/3/0/6/130639337/b90c70677.pdf
    • http://471633614246918175.com/uploads/1/3/0/5/130588263/063c31ae4fa4.pdf
    • http://dynamicsymmetryart.com/uploads/1/3/0/5/130589402/9426547.pdf
    • http://datascienceeurope.com/uploads/1/3/0/7/130775366/a02a8c5c175.pdf
    • http://islandlivingstx.com/uploads/1/3/0/8/130874326/lobujosilag-wakugerilal.pdf
    • http://butleronthebluff.com/uploads/1/3/0/5/130588222/xowidanuvukas_gasesemokix_gubobegub_werujinaxeput.pdf
    • http://ferrariseeker.com/uploads/1/3/0/6/130604968/63820a913.pdf
    • http://cannabisrunvt.com/uploads/1/3/0/6/130604543/jukebomexekopo.pdf
    • http://cpnmailer.com/uploads/1/3/0/7/130775627/zekisefarazeja.pdf
    • http://gracearnold.com/uploads/1/3/0/9/130969445/zodaji-kewonebo-gapire.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009f95.bin
276f0494ec305752efd7882ae72b8b3b052eb90edf9bcaba213810ef752fe9c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F95 9144 bytes
font_01_sfnt_off0000c1c5.bin
da097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC1C5 16224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.