Malicious PDF — malware analysis report

Static analysis result for SHA-256 894d47b739924218…

MALICIOUS

PDF

42.1 KB Created: 2020-03-30 14:54:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 91de333c104ecbe24b9c2ac29b4ddfca SHA-1: be9f2ad86c940bef8a569d3a2728d883d7a2fef3 SHA-256: 894d47b73992421801ef3900b26de7c9f536e6e76184d8250a29204eda325c1e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF document contains a large number of embedded external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. The document body, though partially corrupted, contains a title that appears to be a lure. The primary purpose seems to be directing users to a network of linked websites, potentially for SEO spam, phishing, or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://melbournehotelplaceholder.devsite-1.com/uploads/1/3/0/6/130622104/130622104.html#obra+de+teatro+el+rey+leon+guion+para+ni%C3%B1os PDF link annotation
    • http://charitydiaries.com/uploads/1/3/0/2/130272976/worebiruw-gefonezuwojal.pdfIn PDF document text
    • http://fhbsnc.com/uploads/1/3/1/3/131378990/dudalakovafaw.pdfIn PDF document text
    • http://dewddleskandle.com/uploads/1/3/0/5/130590126/rupolu.pdfIn PDF document text
    • http://elitesip.com/uploads/1/3/0/3/130379424/risimowon_wusedosipojevoj.pdfIn PDF document text
    • http://skialliejohnson.com/uploads/1/3/0/9/130969838/7523991.pdfIn PDF document text
    • http://maxidnyshop.com/uploads/1/3/0/2/130288416/vixut.pdfIn PDF document text
    • http://lilscholarstoo.com/uploads/1/3/0/7/130775916/9611585.pdfIn PDF document text
    • http://propelundone.com/uploads/1/3/0/8/130813831/ba97c442b77b9a.pdfIn PDF document text
    • http://mykayscreations.com/uploads/1/3/0/4/130483443/viwivogabolire.pdfIn PDF document text
    • http://superchargerimpellers.com/uploads/1/3/0/7/130775186/8d7b775a2.pdfIn PDF document text
    • http://hundredxfold.com/uploads/1/3/0/5/130588251/rinolabofu.pdfIn PDF document text
    • http://dyinglightproductions.com/uploads/1/3/0/7/130776737/tuketab_tofazafizow_tumufufosif_fuxuv.pdfIn PDF document text
    • http://bagsofowl.com/uploads/1/3/0/6/130639540/f1b3fdbb286.pdfIn PDF document text
    • http://www.cauliflowerart.com/uploads/1/3/0/7/130738911/5f31fc11f.pdfIn PDF document text
    • http://mtnimmelblueberryfarm.com/uploads/1/3/0/4/130488371/08f40f9e17a698.pdfIn PDF document text
    • http://imakeyoufeelgood.com/uploads/1/3/0/7/130739223/patakiwumozafe-guraxititaxila-zagetamoz-lifup.pdfIn PDF document text
    • http://newencores.com/uploads/1/3/0/2/130288661/9322729.pdfIn PDF document text
    • http://bargalicia.es/uploads/1/3/0/2/130273791/08d67f2a950c.pdfIn PDF document text
    • http://thebrilliantboutique.com/uploads/1/3/0/6/130621359/5177773.pdfIn PDF document text
    • http://dating24.singles/uploads/1/3/0/7/130775744/webemutefisoxed.pdfIn PDF document text
    • http://wedobusinessinsurance.com/uploads/1/3/0/2/130287945/384332.pdfIn PDF document text
    • http://surlocal.com/uploads/1/3/0/2/130287972/wotumibik.pdfIn PDF document text
    • http://prakrutigroups.com/uploads/1/3/0/5/130588633/42cc14161c.pdfIn PDF document text
    • http://74-123-77-80.mgwnet.com/uploads/1/3/0/6/130639178/bufekol.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077e4.bin
32274c7ace8c3e4cb852bb21a3f029753bf88f1693ad94d41bfd08dd635d20f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77E4 8952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.