Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e48b3e3ec58e0be…

MALICIOUS

PDF

40.1 KB Created: 2020-03-29 11:49:47 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c858947de84761e1ab5367ee34215aa4 SHA-1: 3f2fe0027c1a4cf3c49c4972d829e657d249e22c SHA-256: 7e48b3e3ec58e0be29e7d9053ac7492c23f0341c39f15cc4fd629377eb252f42
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of external links, many of which are structured as PDF files with numeric slugs, suggesting a link farm for SEO poisoning or malicious redirection. The document body, though partially obfuscated, contains text related to a 'Toyota corolla s 2015 service manual' and references to wkhtmltopdf, likely a lure to encourage clicks on the embedded URLs. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-63-204-18-8.benefitplans.org/uploads/1/3/0/6/130605167/130605167.html#toyota+corolla+s+2015+service+manual
    • http://oregoncoastbusiness.com/uploads/1/3/1/4/131408942/3235187.pdf
    • http://bothooq.net/uploads/1/3/0/4/130435888/d595b9ec9.pdf
    • http://bobolasnashua.com/uploads/1/3/0/7/130739349/vidufum_guzuwilivelon_nomiba.pdf
    • http://vivagroupusa.net/uploads/1/3/0/3/130323162/4568e978bb7.pdf
    • http://tylerjohngibson.com/uploads/1/3/1/1/131164499/3342293.pdf
    • http://escapekewanee.com/uploads/1/3/0/6/130639840/lerege_kojezogorudaxo_vipifaraj_logurivet.pdf
    • http://adoptcleancopper.com/uploads/1/3/1/1/131164308/cf84a34.pdf
    • http://weenies.online/uploads/1/3/0/5/130589240/bisobawemoxugodod.pdf
    • http://tlos4tes.com/uploads/1/3/0/5/130545800/3765673.pdf
    • http://thecorporatedictionary.net/uploads/1/3/0/3/130323285/6084c5b4ca9e19.pdf
    • http://wollarsolar.com/uploads/1/3/1/3/131380899/6b4b0129.pdf
    • http://psbmb.org/uploads/1/3/0/2/130291593/fa3b3c0a5.pdf
    • http://smeacademy.se/uploads/1/3/1/3/131381363/4fb50da2292.pdf
    • http://tedrabinowitzcopywriter.net/uploads/1/3/0/6/130639140/luviwiwatadoko.pdf
    • http://doreenvelin.com/uploads/1/3/0/7/130738994/fowatiwaluga.pdf
    • http://truthcm.com/uploads/1/3/0/5/130589998/lafepevezizid-bupudezezej-rupufutizukenu-rurugavef.pdf
    • http://achieveeducationalpartners.com/uploads/1/3/0/6/130604940/jawufedimosi_miwam_witedunuzasar_fanatabisir.pdf
    • http://voltdesignz.com/uploads/1/3/0/5/130590511/9eaa53a94.pdf
    • http://strykaposephotography.com/uploads/1/3/1/3/131381374/kuzil.pdf
    • http://cascadeinvestor.com/uploads/1/3/0/9/130968972/xobasupudarene.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072d8.bin
10dbbef287514a1f5982d40d5e1e0e93826b575b5ed16aeab3923c8bc47cea91
pdf-font-stream PDF embedded font (sfnt) at offset 0x72D8 7836 bytes