Malicious PDF — malware analysis report

Static analysis result for SHA-256 8058871707665ab7…

MALICIOUS

PDF

30.2 KB Created: 2020-04-03 04:59:12 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 95028da7f2275d47b46f6e3e49dd91c5 SHA-1: e07bdb3c2dd6a738c447aa5c9f5c55244a2cab6d SHA-256: 8058871707665ab7ecf32ce2aa1a89b04941271696cdbd522706b654fe05a9ac
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, contains a URL that points to a collection of PDF files. The ML classifier strongly indicates maliciousness, suggesting the links are used for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northbaywelding.com/uploads/1/3/0/5/130589115/130589115.html#sopa+de+letras+de+adjetivos+calificativos
    • http://twonk.co/uploads/1/3/0/7/130739170/gikevegujadupo.pdf
    • http://quartztraining.org/uploads/1/3/0/9/130969454/bozafezak.pdf
    • http://ghos7.com/uploads/1/3/1/4/131454222/sozomulavabomezuja.pdf
    • http://ebindependent.com/uploads/1/3/0/5/130589231/tilemav.pdf
    • http://nandevelopment.com/uploads/1/3/0/7/130738822/2bd7fd8be9399d0.pdf
    • http://arvis-olsztyn.pl/uploads/1/3/0/2/130291593/sifuroralofemugibiwa.pdf
    • http://fluidalchemy.com/uploads/1/3/0/9/130969826/bewob.pdf
    • http://csjunioracademy.com/uploads/1/3/1/3/131383510/sereneroruregevo.pdf
    • http://vut.movineurope.cz/uploads/1/3/0/6/130603715/guladekuxunuvevutofu.pdf
    • http://lilyfairjewellery.com/uploads/1/3/1/4/131483348/susakusobewafudazet.pdf
    • http://hkimrealtor.com/uploads/1/3/0/6/130621525/bafivib-beruba-podozividato-bewig.pdf
    • http://wordwatts.com/uploads/1/3/1/0/131070652/gelesogepin.pdf
    • http://joshlane.info/uploads/1/3/0/4/130476410/dijulan-bodibejil-vujekobixoriku.pdf
    • http://emily-webb.com/uploads/1/3/0/2/130291624/697846.pdf
    • http://webcard.online/uploads/1/3/0/2/130289793/8733508.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000052aa.bin
b8f2370e963aabfbb6fdbb091f2dc354a02b262186c7cd0e4fba9a941fbec27f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x52AA 6688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.