Malicious PDF — malware analysis report

Static analysis result for SHA-256 88bd44507f26464f…

MALICIOUS

PDF

76.1 KB Created: 2020-04-04 12:26:49 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: da93015024d0436cb309f6832c9cc6e3 SHA-1: 1d1130be415b17fa65d2f3c43462f68ef8699910 SHA-256: 88bd44507f26464fbe1308e72de406c9ce03ced10bf051c6888cbec23add783c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of external links to other PDF documents hosted on various domains, indicating a link farm or distribution network. The ML classifier strongly flagged this PDF as malicious, and the presence of numerous external URLs supports a malicious intent, likely for SEO manipulation or to serve further payloads. No scripts were extracted, but the structure suggests a malicious document intended to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://optimizewithlol.com/uploads/1/3/0/6/130620968/130620968.html#historial+de+la+empresa+coca+cola
    • http://guafres.com/uploads/1/3/0/7/130775883/8167384.pdf
    • http://tschilledfoodsltd.com/uploads/1/3/0/3/130379625/wobanasogozatow_dixales.pdf
    • http://helplex.de/uploads/1/3/1/4/131437977/7b0dea15f.pdf
    • http://myhealthcareadministration.com/uploads/1/3/0/5/130588237/52b82.pdf
    • http://eco-poet.com/uploads/1/3/0/7/130775521/nularumaju.pdf
    • http://terminal-records.com/uploads/1/3/0/3/130379590/bigemepesifanabi.pdf
    • http://alphegapharmacy-dacgroup.com/uploads/1/3/0/5/130551257/c4f9d6152275116.pdf
    • http://www.pharaon-agency.com/uploads/1/3/0/6/130639740/5575182.pdf
    • http://cds-ma.net/uploads/1/3/0/6/130640174/jusabereg_jugolu.pdf
    • http://royal-honeys.com/uploads/1/3/0/4/130488241/1328531.pdf
    • http://wildroadwanderers.com/uploads/1/3/1/4/131412181/zipirokipuzibezu.pdf
    • http://buddiesgoods.com/uploads/1/3/1/0/131070054/bakuxatemanuvav.pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000de74.bin
2dbbe73efc64b8b97d4de5d852160815187c1380d558bdc6c1048d772034c2df
pdf-font-stream PDF embedded font (sfnt) at offset 0xDE74 10536 bytes
font_01_sfnt_off0001041a.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04
pdf-font-stream PDF embedded font (sfnt) at offset 0x1041A 2616 bytes
font_02_sfnt_off00010d4e.bin
2d9a456853fe6c0446581e4563fb8dc4b722e0b2c528c521fed10db478da25d4
pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4E 16108 bytes