Malicious PDF — malware analysis report

Static analysis result for SHA-256 8eebb6ca23dffc56…

MALICIOUS

PDF

42.1 KB Created: 2020-04-10 11:30:54 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-08-10
MD5: 85b90d32697100b0c8ef09cd1d841fee SHA-1: 3260da8aca99044124f0e9f8c9ad952b8e0c8efc SHA-256: 8eebb6ca23dffc5664184df7d90d785a18263b6ebd8baee3f0bc8ea06ac2cb3f
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, a technique often used for SEO spam or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this pattern, indicating a mass of external PDF links. The document body contains seemingly random text and URLs, further supporting the link farm hypothesis. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stmfraldas.com/uploads/1/3/1/4/131483042/131483042.html#volume+of+a+right+circular+cone+is+9856+cm+cube PDF link annotation
    • http://mikefosterstunts.com/uploads/1/3/0/5/130544387/3f535.pdfIn PDF document text
    • http://mgmalehair.com/uploads/1/3/1/4/131484328/borupatus-pimed-sufazidegojivep-xumapozetolelom.pdfIn PDF document text
    • http://nicewerk.com/uploads/1/3/1/4/131437711/kesusimad-kigogas.pdfIn PDF document text
    • http://aaaconcretinga.com/uploads/1/3/0/9/130969525/gejex-fapomevivika-ralezotag.pdfIn PDF document text
    • http://bitemyselfie.com/uploads/1/3/0/6/130639292/gevij-rukupiwezelapu-videxusiton.pdfIn PDF document text
    • http://noblegoldens.com/uploads/1/3/0/6/130605073/fedudipugori-ramojawe-wapenizavadu-gurasavigolila.pdfIn PDF document text
    • http://fullcircleinvestmentproperties.net/uploads/1/3/0/6/130620578/mojimurewudede_fenobalat_fejap_depedejim.pdfIn PDF document text
    • http://aghomes.org/uploads/1/3/0/4/130435794/noroxo.pdfIn PDF document text
    • http://laurenobern.com/uploads/1/3/0/4/130488395/8518521.pdfIn PDF document text
    • http://sweatthatfat.com/uploads/1/3/0/5/130551106/zelolimo-gejikevoxisur-tibenu.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b61.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B61 7756 bytes
SHA-256: 5efe094564e38588268fb39a58af6b518569716044a9b4aff2b5101bff3355b5
font_01_sfnt_off000079d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79D4 2788 bytes
SHA-256: 985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6
font_02_sfnt_off000083a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83A2 16088 bytes
SHA-256: 287b852d1c1b0334c7d2ab49fe8ac8ac5488f6edefc3e00d5eee83c7048b9cc5

Open this report in the interactive analyzer, or submit your own file for analysis.