Malicious PDF — malware analysis report

Static analysis result for SHA-256 85937c4c5f9c73e5…

MALICIOUS

PDF

52.6 KB Created: 2020-04-09 23:29:54 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 48059476dc2de97803b7ac78ff14badf SHA-1: fc0275c0796d38334bd4da10d6821ab418dc5f80 SHA-256: 85937c4c5f9c73e5a46d25a9fc063d34825d0e6ca827e727be7e4150fe00a68e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links to other PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded document body text, though partially garbled, contains URLs that are also present in the list of extracted URLs, suggesting these links are the primary malicious payload delivery mechanism. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beernationdistributors.com/uploads/1/3/0/5/130539922/130539922.html#ca%C3%ADda+libre+y+tiro+vertical+ejercicios+resueltos PDF link annotation
    • http://getmedalert.net/uploads/1/3/1/4/131406344/b4a5328ee033b8.pdfIn PDF document text
    • http://saturdayeveninggardens.com/uploads/1/3/1/3/131398125/937af7.pdfIn PDF document text
    • http://reedbrook.com/uploads/1/3/1/3/131382081/mavunanoro_resitub.pdfIn PDF document text
    • http://whitemountainremodel.com/uploads/1/3/0/9/130969712/4dbc12ab8f2b6c1.pdfIn PDF document text
    • http://doarse.net/uploads/1/3/1/4/131408854/xosasowonafibo.pdfIn PDF document text
    • http://functionalmedicineforhealth.com/uploads/1/3/0/5/130588603/9080357.pdfIn PDF document text
    • http://drencheddivers.com/uploads/1/3/0/6/130605248/finob.pdfIn PDF document text
    • http://thetrendycowgirlboutique.com/uploads/1/3/0/5/130542734/2709722.pdfIn PDF document text
    • http://corinnaraeyoga.com/uploads/1/3/0/6/130603819/rivekosikegibi.pdfIn PDF document text
    • http://nfctigers.com/uploads/1/3/1/4/131438523/103d7128.pdfIn PDF document text
    • http://breaktobrush.com/uploads/1/3/0/4/130436162/remoxafufa_tugekigemafima.pdfIn PDF document text
    • http://empleos.fun/uploads/1/3/1/1/131164007/4688457.pdfIn PDF document text
    • http://thegardenstategreat.com/uploads/1/3/0/7/130775902/wapos.pdfIn PDF document text
    • http://teachingallpeople.com/uploads/1/3/0/5/130551697/33fe2cacde87.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f78.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F78 6444 bytes
SHA-256: 1957428794578a072b8983e864e5701b52391162abfb2d6d14c6295fa8a16687
font_01_sfnt_off00007f3a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7F3A 8280 bytes
SHA-256: ed40df269913c96c4d90b11d63e5361361c6f4b47b0f8dc13835d1c516773523
font_02_sfnt_off00009da6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9DA6 3704 bytes
SHA-256: a17c0593d5d519e99d55f917317ab54813164a5c96b470a394f526877d458548
font_03_sfnt_off0000ab7c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xAB7C 16344 bytes
SHA-256: 322701f1f7ce52f1e2c270a0bb3090cbbccd2613e2548c816e08e746c3346379

Open this report in the interactive analyzer, or submit your own file for analysis.