Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ece543540677a19…

MALICIOUS

PDF

79.5 KB Created: 2020-05-22 04:53:58 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-04
MD5: 41d8410665237408ddc869be4d6a909c SHA-1: b3e78f6c95866fc40e6afae7d7bfbb7cae38ec5a SHA-256: 8ece543540677a198d7f4351c23e69b7326d0f995d17eff27559af7983a40a2e
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files. The primary link in the document body suggests a lure to download 'psiphon pro for pc portable'. This indicates a likely attempt to distribute potentially unwanted software or facilitate further malicious activity through a link farm. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://taiyangcheng128msc.br3h.com/uploads/1/3/1/4/131406289/131406289.html#descargar+psiphon+pro+para+pc+portable PDF link annotation
    • http://true-excellenceforpets.com/uploads/1/3/0/7/130738646/3442627.pdfIn PDF document text
    • http://buddyguardsco300.com/uploads/1/3/0/5/130543798/soxuze-givuravorun-woxusip-ginonatowap.pdfIn PDF document text
    • http://apoiesis.com/uploads/1/3/1/3/131383837/jilupodesixogekaxuja.pdfIn PDF document text
    • http://remarkablytaylord.com/uploads/1/3/0/7/130739635/noxakodegizu.pdfIn PDF document text
    • http://bipingpatelmd.com/uploads/1/3/0/6/130603935/64d9066.pdfIn PDF document text
    • http://jllcapitalmarkets55westmonroe.com/uploads/1/3/0/5/130539672/xegur_jumuli.pdfIn PDF document text
    • http://agileand.com/uploads/1/3/1/3/131398188/5483784.pdfIn PDF document text
    • http://lambertconsultingservices.org/uploads/1/3/0/2/130289541/benekodof-wobarimuzep.pdfIn PDF document text
    • http://annieautosales.com/uploads/1/3/1/3/131379830/zemixobuz-faxaluba-pejoriv.pdfIn PDF document text
    • http://employeeadvocateinstitute.com/uploads/1/3/0/9/130969973/c9316e6642109.pdfIn PDF document text
    • http://organizedmess.net/uploads/1/3/0/8/130814021/65f2f6.pdfIn PDF document text
    • http://maryreinhardtesl.com/uploads/1/3/1/6/131607239/3762542.pdfIn PDF document text
    • http://gustafsonheatingair.com/uploads/1/3/1/4/131483197/novazireva-xovolaxipakawu-juzijin.pdfIn PDF document text
    • http://robleofficesolutions.com/uploads/1/3/1/4/131412491/87eddbd5.pdfIn PDF document text
    • http://bossybastienne.com/uploads/1/3/0/8/130874247/fufatunupexitexi.pdfIn PDF document text
    • http://relationshipsuccesscoach.com/uploads/1/3/1/4/131483061/9126818.pdfIn PDF document text
    • http://gainahealthylife.com/uploads/1/3/0/3/130324206/ff7659eae1f557.pdfIn PDF document text
    • http://chiefsocialmedia.com/uploads/1/3/0/6/130604292/7858784.pdfIn PDF document text
    • http://itprojectmanager.info/uploads/1/3/0/2/130289339/nulevawudazigon_wulalu.pdfIn PDF document text
    • http://created4youfoods.com/uploads/1/3/1/3/131379584/83840c1eb.pdfIn PDF document text
    • http://islnd.store/uploads/1/3/0/5/130551112/wedikanevezomojumi.pdfIn PDF document text
    • http://www.thdl.org/http://www.thdl.org/TibetanIn PDF document text
    • http://www.opentle.orgIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlTibetanIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://www.gnu.org/licenses/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://scripts.sil.orgIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 9

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_009_off0001022a.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1022A 17920 bytes
SHA-256: cb061cdc5647ba3f7e6f2592f482d00d1faabf2446d7ff81c879d22d2084ee84
font_00_sfnt_off00006cf3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6CF3 8644 bytes
SHA-256: 463695812f0090d4cc8568ad90ffa2228177c598282e76b039f6294399715446
font_01_sfnt_off00008378.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8378 4724 bytes
SHA-256: 7beda5eb7a5a87e9da7213ac1316c339fac62d74ee05582442241009f88c6a07
font_02_sfnt_off00009438.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9438 4140 bytes
SHA-256: 119132d4d86df12b64aacef50f1aeac69cc60fdd8dbe27b6e2ceb22654f0acbc
font_03_sfnt_off0000a163.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA163 9884 bytes
SHA-256: 0068b81550ae4f8ea6d60bd7a77fb484485cfd6e896dfd3f16f26d306b70cf4f
font_04_sfnt_off0000b60c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB60C 5032 bytes
SHA-256: a47959a8a0c44ddf6b8e998b6dd727bd4d99d6980137c168d359ab97f64ba13a
font_05_sfnt_off0000c574.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC574 6640 bytes
SHA-256: 2da83060ad210a9a1743b04a22b2cc5ebb14ba7af64fbaa5f25da2d26a1b3d84
font_06_sfnt_off0000d712.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD712 13992 bytes
SHA-256: d50e1ba4053c27ed0fcaca3872c429d46983b730eabf407c0dc97226f4a1730e
font_08_sfnt_off00011d96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D96 4612 bytes
SHA-256: 1309a472ed192960e18337bec6a1efced6126a680acbb360bfd84c0f0adfdc1c

Open this report in the interactive analyzer, or submit your own file for analysis.