Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e9f40441dfe75c0…

MALICIOUS

PDF

30.6 KB Created: 2020-06-03 13:51:31 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-08-25
MD5: 6f8b31b5dd36cd9faac78d49ebf3713d SHA-1: 4b93c48fc389f5d69411f6c135e04e4407d2571e SHA-256: 7e9f40441dfe75c0e20c6c62d798577daae29dda92eaecdc6e4bcf223f4c5e94
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The embedded document body text, though heavily obfuscated, contains references to URLs that are also present in the list of extracted URLs. The ML classifier strongly indicates maliciousness, suggesting the primary purpose is to redirect users to a network of linked content, potentially for SEO manipulation or to serve further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://generationsofpurpose.com/uploads/1/3/1/6/131637686/131637686.html#dandelion+girl+designs PDF link annotation
    • http://arbitrorealtors.in/uploads/1/3/0/3/130313212/018b08e9624a.pdfIn PDF document text
    • http://ltcsoftball.org/uploads/1/3/0/6/130639175/6233131.pdfIn PDF document text
    • http://autodiscover.kylahraetoday.com/uploads/1/3/0/2/130288549/5343834.pdfIn PDF document text
    • http://softhavenleggings.com/uploads/1/3/0/6/130621664/sonusad_luxiguseviguk_zuwix_rifupozu.pdfIn PDF document text
    • http://mta-sts.mail.brownswoodnursery.com/uploads/1/3/1/4/131438003/19ac3.pdfIn PDF document text
    • http://drgservices.info/uploads/1/3/0/6/130604386/libeguxonoxu_jebererof.pdfIn PDF document text
    • http://beijingpost.org/uploads/1/3/1/4/131453960/3a97722e05d.pdfIn PDF document text
    • http://pastoralpopcorn.com/uploads/1/3/0/6/130621496/votatax.pdfIn PDF document text
    • http://generationsofpurpose.com/uploads/1/3/1/6/131637686/terms.htmlIn PDF document text
    • http://generationsofpurpose.com/uploads/1/3/1/6/131637686/dmca.htmlIn PDF document text
    • http://generationsofpurpose.com/uploads/1/3/1/6/131637686/policy.htmlIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://vikotefo.files.wordpress.com/2020/05/44495577694.pdfIn PDF document text
    • https://wamilinapu.files.wordpress.com/2020/05/jimezo.pdfIn PDF document text
    • https://zokuvadezod.files.wordpress.com/2020/05/wojowuvixuwadajofixuf.pdfIn PDF document text
    • https://kisesut.files.wordpress.com/2020/05/73534566872.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004fb0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4FB0 9168 bytes
SHA-256: 956b1d40c2740041b8f68cf14dce3ac0383db5379c30d5c6ea12dc5692208c80

Open this report in the interactive analyzer, or submit your own file for analysis.