Malicious PDF — malware analysis report

Static analysis result for SHA-256 85088e5be439525f…

MALICIOUS

PDF

39.6 KB Created: 2020-03-30 10:54:30 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6888fddb70cb7b2bf5619a26668db0a7 SHA-1: 8a319df09e3b366ccf9d9aa531cecf3d315ff557 SHA-256: 85088e5be439525fb41c7c06805519c1c549dc9aaa076e0d3c6b2d1ace96e20f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF document, generated by wkhtmltopdf, contains a large number of embedded URLs pointing to various PDF files hosted on different domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external link farm, suggesting a tactic to manipulate search engine results or distribute malicious content. The document body, though partially corrupted, contains a URL that appears to be a lure for unit conversions, likely a pretext to drive traffic to the linked resources. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aldensuites.devsite-1.com/uploads/1/3/0/7/130739387/130739387.html#equivalencias+de+metros+cubicos+a+toneladas
    • http://krei-energy.com/uploads/1/3/0/8/130814229/5a2d7.pdf
    • http://parkercarpentrydesigns.com/uploads/1/3/0/6/130640235/lalesekiditepi-walofodeto-voxopefoxupasa-fijumizefopanag.pdf
    • http://phoenixeditorial.org/uploads/1/3/0/4/130476158/0457f2bc21c1d.pdf
    • http://isanetshop.com/uploads/1/3/1/3/131380687/vuxijezizevim.pdf
    • http://janycecondon.com/uploads/1/3/0/3/130313489/ee3c12d.pdf
    • http://mixologymakeup.com/uploads/1/3/1/0/131070938/luzidufivogulutoxofa.pdf
    • http://advancedspeedtechnologies.com/uploads/1/3/0/8/130814902/3031774.pdf
    • http://jeskids.org/uploads/1/3/1/4/131406506/ruwupinujonuvuxuf.pdf
    • http://carbonsoccer.com/uploads/1/3/0/6/130604046/83c9b52d79.pdf
    • http://kellysandau.com/uploads/1/3/0/5/130588352/608211dd81.pdf
    • http://shactiro.com/uploads/1/3/0/7/130739348/1816081.pdf
    • http://growerconsultants.com/uploads/1/3/0/9/130969561/tabajozezumebeb.pdf
    • http://sandras-realtor.com/uploads/1/3/0/6/130621651/zapebizugupemilel.pdf
    • http://feedersarchery.com/uploads/1/3/0/7/130776393/9b2f9afe241353.pdf
    • http://charitytothestreet.com/uploads/1/3/0/6/130639665/bigutoj.pdf
    • http://dracoshairco.com/uploads/1/3/0/2/130270826/vozavurofinakoguw.pdf
    • http://artfarmgraphics.com/uploads/1/3/0/3/130313212/8957fd.pdf
    • http://www.centrestagedanceacademy.com/uploads/1/3/1/4/131454503/121d0a98c9d4c6.pdf
    • http://signacarenewross.ie/uploads/1/3/0/3/130323405/fotuzusosademaxil.pdf
    • http://nextstopcoffeeshop.shop/uploads/1/3/0/7/130776511/111a82a1911.pdf
    • http://legconmex.com/uploads/1/3/0/5/130547340/c1a28592fbeb7f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007201.bin
e6dc3bc3cc8e95b1de7da90eb536855aa082fade6b88803448497edc2c0403c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7201 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.