Malicious PDF — malware analysis report

Static analysis result for SHA-256 8334fdbe52340098…

MALICIOUS

PDF

47.2 KB Created: 2020-03-25 10:19:07 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 50ac7e26c33d5538470850b85031a1ff SHA-1: 6235d1559bb332994bc526dedb7a03ad4fbb045b SHA-256: 8334fdbe52340098d57319491a05fc151d54398272f7d003edad1d487111ef20
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. These links likely lead to further malicious content or phishing pages, and the document itself appears to be a lure to generate traffic to these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thegatheringkzoo.com/uploads/1/3/0/7/130775275/130775275.html#teoria+socio+critica+concepto
    • http://shopsexxyness.com/uploads/1/3/0/5/130589090/936a03f9e40e3a.pdf
    • http://nothernlotusayurveda.com/uploads/1/3/0/2/130272977/74097ec47f054.pdf
    • http://indianrockspoa.com/uploads/1/3/0/2/130288363/muvejiw.pdf
    • http://shapnas.com/uploads/1/3/0/2/130272325/ludewijimap_bemunaso_woxadatuki.pdf
    • http://www.artcongroup.com/uploads/1/3/0/5/130589131/2477.pdf
    • http://bakerstoves.com/uploads/1/3/0/2/130287527/fc61c3d8a1.pdf
    • http://claireallegrataylor.com/uploads/1/3/0/5/130539738/folofumepaw.pdf
    • http://thespeckledhen.shop/uploads/1/3/0/7/130775573/9888038.pdf
    • http://mrmoneyfitness.com/uploads/1/3/0/4/130435531/4595901.pdf
    • http://halowenamioty.pl/uploads/1/3/0/8/130813362/tuwuse_fuboxakogolefod_jazipuwelif.pdf
    • http://winnickbrennancommunications.com/uploads/1/3/0/4/130491166/8979158.pdf
    • http://www.mackbrosgroundskeeping.org/uploads/1/3/0/6/130604741/revizigota-kumir-tadolu-rixekevukuv.pdf
    • http://yourflexpack.com/uploads/1/3/0/7/130740097/nasavumijoxob_babik_rumokox.pdf
    • http://visionfreelance.net/uploads/1/3/0/7/130775462/wegasekofivevuxiviv.pdf
    • http://hostmaster.celticmistminiaturehorses.com/uploads/1/3/0/4/130436141/lapefavil-mapawixoxuse.pdf
    • http://www.mcs-lawyers.com/uploads/1/3/0/7/130739552/vuwipar.pdf
    • http://insidedentalequipment.net/uploads/1/3/0/6/130621868/3525286.pdf
    • http://calarco.hopkins.edu/uploads/1/3/0/6/130622066/xekozuxo.pdf
    • http://getmixgen.com/uploads/1/3/0/6/130604844/zidawifuves_denodinomuset_gopapabelem_bobode.pdf
    • http://greysay.tech/uploads/1/3/0/6/130640209/gazabaxudibul.pdf
    • http://khanomar.com/uploads/1/3/0/2/130271243/9867721.pdf
    • http://www.weather-capital.com/uploads/1/3/0/3/130313203/marorejafegip.pdf
    • http://mfhinvestments.com/uploads/1/3/0/2/130272937/fujapesokevado.pdf
    • http://androidisfor.me/uploads/1/3/0/6/130621576/ralogefegobuva-lawelas-bijudazisoxopom.pdf
    • http://kelzfm.com/uploads/1/3/0/9/130969139/aba62a583b7b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008d9f.bin
67b910e6f2c707dbe8c8b40e9d96eac0861659c48f7a3bb0ec9d43653572a4ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D9F 8732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.