Malicious PDF — malware analysis report

Static analysis result for SHA-256 81e71b0eb063c5b9…

MALICIOUS

PDF

42.4 KB Created: 2020-04-02 09:13:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4afbcf3f58e57fa54335228e295efa5a SHA-1: c9ba2d61a66b501883617694cb50e75eed791634 SHA-256: 81e71b0eb063c5b97603e971ed0915389e8b2c686b9d4034cbdadca27f4d9b20
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. The document body, though partially corrupted, contains a URL that is also present in the list of external links. This suggests the primary purpose is to redirect users to a network of websites, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://luxurylashesandbrowsco.com/uploads/1/3/0/8/130874277/130874277.html#imagenes+gracias+por+tu+linda+amistad+amiga
    • http://oaklandbees.com/uploads/1/3/0/9/130969492/vuvejiletuzedin.pdf
    • http://photobooth11.com/uploads/1/3/0/2/130289220/migeto.pdf
    • http://seasidescribe.com/uploads/1/3/0/3/130323315/vitiwoz.pdf
    • http://brexitdiary.com/uploads/1/3/0/5/130588278/3515168.pdf
    • http://mailboxgobbler.com/uploads/1/3/0/5/130590208/5102468.pdf
    • http://parnelldrum.studio/uploads/1/3/0/8/130813692/mazojaxop.pdf
    • http://sowerscontractingncllc.com/uploads/1/3/0/4/130435978/rusige.pdf
    • http://gimmeesumsugar.org/uploads/1/3/0/6/130621094/5290563.pdf
    • http://arraysense.com/uploads/1/3/0/5/130540097/1002144.pdf
    • http://carpenterbangalore.com/uploads/1/3/0/7/130775321/28db0b626aeeb0.pdf
    • http://esivu.fi/uploads/1/3/0/7/130776015/gumovase-jijawenusevakek-votujo-xavuvufivowi.pdf
    • http://saldanhahealthcentre.com/uploads/1/3/0/8/130813115/e7168.pdf
    • http://joyfulheartarts.com/uploads/1/3/0/2/130273850/302338.pdf
    • http://andrimargamboa.es/uploads/1/3/0/4/130435654/wirel.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b2f.bin
13585b3e7483676e68f833fb13937db34208716a6f088cb44974c207d4ed62c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B2F 8636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.