Malicious PDF — malware analysis report

Static analysis result for SHA-256 801f9b1e9429ce1c…

MALICIOUS

PDF

41.0 KB Created: 2020-03-30 09:17:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 334e06c9d3ccbccc1042d58f08759601 SHA-1: 461c310acdcef2ab31327eb2368fee2191c3306e SHA-256: 801f9b1e9429ce1c297b68dda8776f47223f51c4a68b002a59e256ad7854f177
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially obfuscated, contains URLs that are also present in the list of extracted URLs. This suggests the primary purpose is to redirect users to a network of websites, likely for SEO spam or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://corustest.devsite-1.com/uploads/1/3/1/4/131409841/131409841.html#metodos+para+lectura+comprensiva PDF link annotation
    • http://boldcounsel.net/uploads/1/3/0/5/130543264/3410874.pdfIn PDF document text
    • http://sukhayogi.com/uploads/1/3/0/2/130287847/nezizol.pdfIn PDF document text
    • http://livingmetroeast.com/uploads/1/3/0/4/130483583/nojogetev.pdfIn PDF document text
    • http://karnevalverein-seitzenhahn.de/uploads/1/3/0/8/130873784/b45e5.pdfIn PDF document text
    • http://mariacarasuarez.com/uploads/1/3/1/4/131437875/bomekizijelilera.pdfIn PDF document text
    • http://casinoonlineaustralia.com/uploads/1/3/0/5/130551805/purukafijavenop.pdfIn PDF document text
    • http://babiesbuildersandbakers.com/uploads/1/3/0/6/130621135/nupirobaguzajoz.pdfIn PDF document text
    • http://twigachai.com/uploads/1/3/0/6/130620601/f5a581e0.pdfIn PDF document text
    • http://mychickadeecreekgiants.com/uploads/1/3/0/3/130323515/b1343.pdfIn PDF document text
    • http://afsaneh-ehsani.net/uploads/1/3/0/4/130477346/d7a3c9897.pdfIn PDF document text
    • http://uniquekidsedu.com/uploads/1/3/0/6/130605186/6e125c5a.pdfIn PDF document text
    • http://babymassagesydney.com/uploads/1/3/0/4/130483443/guzep_sidosuzedax_kejapot.pdfIn PDF document text
    • http://hospitalequipment4u.com/uploads/1/3/0/5/130588616/3946282.pdfIn PDF document text
    • http://lunarescape.net/uploads/1/3/0/4/130489350/kogufijetuzosunari.pdfIn PDF document text
    • http://coreydennison.net/uploads/1/3/0/6/130639809/zezexefazo.pdfIn PDF document text
    • http://zailiyazaita.com/uploads/1/3/0/5/130544437/3253265.pdfIn PDF document text
    • http://juvenilejusticelaw.com/uploads/1/3/0/4/130476859/3451af4493.pdfIn PDF document text
    • http://flohonline.com/uploads/1/3/0/4/130489072/6593198.pdfIn PDF document text
    • http://zucksstamps.com/uploads/1/3/0/5/130540193/gunogabipesiliduvaw.pdfIn PDF document text
    • http://resultscasemanagement.com/uploads/1/3/1/1/131164383/wupoluburetoxu_pozis_zawomuwuwemubeg.pdfIn PDF document text
    • http://nexus.ph/uploads/1/3/0/9/130969341/f87ab50.pdfIn PDF document text
    • http://okiegear.net/uploads/1/3/1/3/131398176/3026551.pdfIn PDF document text
    • http://64-160-90-232.pacific-solutions.com/uploads/1/3/0/6/130640029/vodosirafafutob-dizojebusis-reresos-papuresol.pdfIn PDF document text
    • http://sowgrow.net/uploads/1/3/0/8/130814288/xifumekefo-benoviw.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075ac.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x75AC 8536 bytes
SHA-256: 1b219acaae49222c20b5ae855715787cc4b0e038afaa29e9908096a3c334b99f

Open this report in the interactive analyzer, or submit your own file for analysis.