Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c69bf39753b2a70…

MALICIOUS

PDF

48.9 KB Created: 2020-03-11 08:12:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ec9338629eda478c6394ea9a12b63088 SHA-1: 1b375293a64027512689e8695df63ddd97705ce0 SHA-256: 8c69bf39753b2a707907a56d1b6f6ad7c69abbd9b00e801c5100a7b7d57bb150
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The embedded document body also contains a primary URL that points to an HTML file, which in turn likely contains more links. This structure strongly suggests a link farm or SEO poisoning attack, designed to drive traffic to malicious or compromised sites. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-64-169-66-165.millerpac.com/uploads/1/3/0/3/130323774/130323774.html#light+novel+arifureta+vol+8+bahasa+indonesia
    • http://www.capitalchoicegulfcoast.com/uploads/1/3/0/6/130621488/acef5acd237.pdf
    • http://jessicawcheung.com/uploads/1/3/0/8/130873971/lotosof.pdf
    • http://admin.seramygames.com/uploads/1/3/0/8/130874150/fcca12b11f1.pdf
    • http://buildbelievers.com/uploads/1/3/0/4/130483341/4058545.pdf
    • http://www.forinspiration.co.uk/uploads/1/3/0/4/130491001/409d46cb.pdf
    • http://naturalacumen.com/uploads/1/3/0/5/130551619/1364938.pdf
    • http://bcreativedesignandservices.com/uploads/1/3/0/6/130621622/nabuderazepa.pdf
    • http://cloud2groundstudios.com/uploads/1/3/0/4/130476456/8724491.pdf
    • http://smart-k9.com/uploads/1/3/0/6/130639333/vusevarofomopup.pdf
    • http://appzel.com/uploads/1/3/0/6/130620965/lagoli-momodige-geginegosi.pdf
    • http://dev2design.com/uploads/1/3/0/3/130324248/wafabulujiro.pdf
    • http://www.buttonprairiefarms.com/uploads/1/3/0/3/130323957/kodadasapuwuko.pdf
    • http://eastbournewindowcleaning.com/uploads/1/3/0/7/130776101/4376081.pdf
    • http://kwakwa.com/uploads/1/3/0/2/130291996/tirenovuxutabefo.pdf
    • http://www.1815columbia.com/uploads/1/3/0/4/130483402/zawedufufumomujo.pdf
    • http://rockthehut.com/uploads/1/3/0/7/130775911/116208.pdf
    • http://fishtownshops.com/uploads/1/3/0/7/130740419/7309708.pdf
    • http://michaelhiggins.ie/uploads/1/3/0/4/130488500/767410.pdf
    • http://www.askitchennklutter.com/uploads/1/3/0/2/130289503/ea9b13aa5001a.pdf
    • http://horsethemegifts.co.uk/uploads/1/3/0/6/130622116/7318184.pdf
    • http://templehousepainting.com/uploads/1/3/0/7/130738870/sabuwufuvo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077a0.bin
2d72271ac5e557ce5be99109a55f5c09df047073ca4b618a542232a34d64fb17		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77A0 8292 bytes
font_01_sfnt_off00009703.bin
bafff57f0bd67e82dd1d3a3f92c460c33febd5ad4e6ded4753c56c43a8c487e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9703 9408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.