Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d137ce0234063b5…

MALICIOUS

PDF

50.0 KB Created: 2020-03-21 02:09:21 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 08c8f5edd06459478e838e79164b53e1 SHA-1: 9f9a1fcede7270fbbc9a28e9feb7a069bc05ed0a SHA-256: 8d137ce0234063b53f5836d9a53d1fc0589c4a0c29f81190b1800d4ed3eaf250
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness. The document body, though partially corrupted, contains a title that could be a lure, and the embedded URLs point to various domains, suggesting a link farm or redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abraxasroots.org/uploads/1/3/0/6/130639906/130639906.html#the+whisper+emma+clayton+read+online
    • http://www.bigd401k.com/uploads/1/3/0/2/130289723/vonazivo_xowopotonugef.pdf
    • http://medicine4rebels.com/uploads/1/3/0/5/130590208/9639380.pdf
    • http://www.missfitonline.com/uploads/1/3/0/4/130483341/femeludix.pdf
    • http://www.davidcallanancelebrancyservices.com/uploads/1/3/0/3/130379676/kasigobasilazexe.pdf
    • http://kissmybliss.com/uploads/1/3/0/5/130540046/80101.pdf
    • http://shahnishant.com/uploads/1/3/0/2/130289735/01d0c.pdf
    • http://giveittogod.net/uploads/1/3/0/2/130272232/7011901.pdf
    • http://www.rely-a-scope.com/uploads/1/3/0/9/130969809/bofiwazugamesutog.pdf
    • http://fartherhigherfaster.net/uploads/1/3/1/0/131070786/lobujoboro.pdf
    • http://www.isitjennsbirthday.com/uploads/1/3/0/2/130289296/sorumumutij.pdf
    • http://bhmiii.com/uploads/1/3/0/6/130639939/48709d455.pdf
    • http://shermanportfolio.com/uploads/1/3/0/9/130969925/7813570.pdf
    • http://siroculusdesigns.com/uploads/1/3/0/2/130291029/c6b2c6.pdf
    • http://brittany-paris.net/uploads/1/3/0/4/130476242/8906307.pdf
    • http://nstrajectory.org/uploads/1/3/0/2/130289498/lamesepifu.pdf
    • http://218a4293p6rb.com/uploads/1/3/0/8/130814579/jebirutezofojareb.pdf
    • http://mrsjdodds.com/uploads/1/3/0/2/130289693/naxuzipibimu.pdf
    • http://kidsphilharmonic.com/uploads/1/3/0/3/130379523/fifoguja_zemidazixavami_kepev.pdf
    • http://coffeeandartfestival.com/uploads/1/3/0/7/130738716/nejumo-lexokivenum-zixipof.pdf
    • http://killedinactionfilm.com/uploads/1/3/0/6/130639827/kitate.pdf
    • http://englishfast.org/uploads/1/3/0/8/130874164/871368.pdf
    • http://projectdezine.com/uploads/1/3/0/3/130379194/cebf53d719b.pdf
    • http://soundanddoctrine.com/uploads/1/3/0/6/130603721/8376042.pdf
    • http://hutteritelife.com/uploads/1/3/0/7/130776535/6d8e6b232.pdf
    • http://artbytravis.com/uploads/1/3/0/6/130640004/sosifabo.pdf
    • http://artbytravis.com/uploads/1/3/0
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008bfa.bin
5bbb9eed6bc418cd6477329cd61a72f6491c657ee09a74391adad46ffae369a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BFA 8732 bytes
font_01_sfnt_off0000ad52.bin
885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD52 4144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.