Malicious PDF — malware analysis report

Static analysis result for SHA-256 8566c6ee9754efee…

MALICIOUS

PDF

39.0 KB Created: 2020-04-02 20:43:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: fb54c5d46242ea7a80df8923ce5bb283 SHA-1: 306a678118a6fd74753dca518619fa2d9f383e7f SHA-256: 8566c6ee9754efee916069553b24d19ae38033f3db6e385344a5f6ba538450f6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary link points to 'http://bestbuy7.co/uploads/1/3/0/7/130775518/130775518.html#conan+exiles+black+hand+armor+recipe+location', suggesting a lure for game-related content to drive traffic to potentially malicious sites. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bestbuy7.co/uploads/1/3/0/7/130775518/130775518.html#conan+exiles+black+hand+armor+recipe+location
    • http://interactivegamessales.com/uploads/1/3/0/6/130639489/judavanetekorepenego.pdf
    • http://onemillionhusbands.com/uploads/1/3/0/8/130814718/e1ae51.pdf
    • http://thelion.ca/uploads/1/3/1/3/131379373/4478837.pdf
    • http://willowlakeconstructionllc.com/uploads/1/3/0/8/130874039/5df57c44cfab879.pdf
    • http://somethingpurple.org/uploads/1/3/0/7/130775309/musosokix-fufewuz-fulut-zotimidobiloze.pdf
    • http://ns2rebel.com/uploads/1/3/0/7/130775704/6875564.pdf
    • http://trentsandifur.com/uploads/1/3/0/7/130776049/bemos-xapamedafibiga.pdf
    • http://gaffneyeducationalconsulting.com/uploads/1/3/0/7/130739987/bibij.pdf
    • http://independentwatersolutions.ca/uploads/1/3/0/2/130270956/jepekano.pdf
    • http://rkinternationals.com/uploads/1/3/0/3/130313015/a175f6b77c2e6b9.pdf
    • http://tarowaterhousinghi.com/uploads/1/3/1/4/131407035/92a03.pdf
    • http://1simpledownload.com/uploads/1/3/0/5/130540868/328690.pdf
    • http://forb-courses.org/uploads/1/3/0/7/130775682/lepopimiduxixovuw.pdf
    • http://lawyerturnedgypsy.com/uploads/1/3/0/8/130814017/6450664.pdf
    • http://immersivesoundexperience.com/uploads/1/3/0/6/130639143/ae71375f88659.pdf
    • http://inlasvegas.us/uploads/1/3/0/4/130488286/diluweloz-vanov-niguwokoj.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000070d4.bin
4d48762a1b5c1a2b56abbc3401aa4545355081749e2f047ec595d0e069e2a4b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70D4 7648 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.