Malicious PDF — malware analysis report

Static analysis result for SHA-256 8ee1fde4d5d93417…

MALICIOUS

PDF

41.1 KB Created: 2020-04-11 18:41:22 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d169a6c3e00b49e5e79cbd5f9ae45955 SHA-1: bb2a32f65ed48870c650d62671e73d0b48478634 SHA-256: 8ee1fde4d5d9341735ba5ca2de83be4d8583715e4f368efc2c9b18d5a4c81152
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, identified as a PDF link farm. The ML classifier strongly indicated maliciousness, and the presence of numerous links to domains like 'magentaray.com' and 'waterinnovationsgroup.com' suggests a coordinated effort to redirect users, likely to malicious content or phishing pages. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://waterinnovationsgroup.com/uploads/1/3/0/5/130590714/130590714.html#%EC%B5%9C%EA%B0%95+%EB%B0%B0%EB%8B%AC%EA%BE%BC+1%ED%9A%8C+%EB%8B%A4%EC%8B%9C%EB%B3%B4%EA%B8%B0
    • http://magentaray.com/uploads/1/3/1/3/131398539/1cbcd6918a.pdf
    • http://gospelrescuemissionfellowship.net/uploads/1/3/0/4/130435922/1e1fa1.pdf
    • http://thomsonreuterslab.com/uploads/1/3/0/8/130813705/pudulunol.pdf
    • http://jccdark.org/uploads/1/3/1/0/131070791/xunoxoji.pdf
    • http://rmmsocial.com/uploads/1/3/0/8/130814861/bugijiw_jinokob_modebu.pdf
    • http://schloempy.com/uploads/1/3/0/7/130776553/3b91d7222c8.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bf2.bin
f150050e04f0b467c9e5cb8183ea6784dced5425a079c5a21f41d2a342dfb9b2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BF2 6748 bytes
font_01_sfnt_off000066cf.bin
244ea1d049c7c022e135a99bdf11a2fb2d527388b709435a8605220a0d688f86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66CF 15960 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.