Malicious PDF — malware analysis report

Static analysis result for SHA-256 9273855c1eeaba3d…

MALICIOUS

PDF

40.1 KB Created: 2020-05-18 08:29:37 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: f34b17c50e387a93b1b689a17fbceaa1 SHA-1: 5333071e59f91ffbbcdc7ce695112f5fb84b6481 SHA-256: 9273855c1eeaba3d1efea148ffb383994f38e10c2c976a56fa016f6f85688e0e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The ML classifier strongly indicated maliciousness. The document body, though partially corrupted, includes a URL that is also present in the list of extracted URLs, suggesting a deliberate attempt to link to external resources. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hombresolterobuscodama.com/uploads/1/3/1/3/131380983/131380983.html#nsw+food+authority+food+safety+guidelines
    • http://az60industrial.com/uploads/1/3/0/5/130544746/gabimefax_lekovibusaf.pdf
    • http://leicatestdrive.nl/uploads/1/3/0/9/130969042/1465279.pdf
    • http://flixtarproductions.com/uploads/1/3/0/3/130313144/fotemijemodudad.pdf
    • http://vibrantabasolutions.com/uploads/1/3/0/5/130538862/f5f27e.pdf
    • http://highqualitylife.org/uploads/1/3/1/4/131407377/ninovodim.pdf
    • http://southwestprofessionaldeckrepair.com/uploads/1/3/0/6/130639851/mofamatogalun-novej.pdf
    • http://789384669264936532.org/uploads/1/3/0/2/130291702/gorazowefeg-wakeladamukeko-razebufazov-zixenenowewisip.pdf
    • http://hasanhelou.com/uploads/1/3/0/3/130313093/mapuxovunude-reboxemafewewej.pdf
    • http://transformator-tfzm.ru/uploads/1/3/0/6/130640194/43f8ff85d.pdf
    • http://nickfysz.com/uploads/1/3/1/3/131379541/7b9fd.pdf
    • http://susancartondesigns.com/uploads/1/3/1/1/131164023/4487568.pdf
    • http://mytamaragarcia.com/uploads/1/3/1/4/131453226/6802317.pdf
    • http://imran-gujjar.com/uploads/1/3/0/4/130435780/fasemurijajo_tuwuzixabe.pdf
    • http://jackupwithjack.com/uploads/1/3/1/8/131856141/dipavozupa_fimeluxuj_mesapudidejes.pdf
    • http://dj-imba.com/uploads/1/3/1/3/131382673/77fbebbfcdc.pdf
    • http://premium-solar.com/uploads/1/3/0/6/130639450/ad84d29.pdf
    • http://nikonicreagan.com/uploads/1/3/0/6/130604222/jamavi-rirafox-dexasutokowawu-mulewafimepi.pdf
    • http://anutrend.net/uploads/1/3/1/6/131607305/monavujalemilep.pdf
    • http://fnqconsulting.com/uploads/1/3/1/6/131636766/tilejevilisijajujas.pdf
    • http://trimanity.com/uploads/1/3/0/3/130323896/vijexubakif.pdf
    • http://dtzsites.com/uploads/1/3/0/8/130814157/rotedereditelib.pdf
    • http://teaching-philosophy-be-amazing.com/uploads/1/3/0/5/130588735/gunosisatedex-voxitetefifesa-fosutiwuzefaxa.pdf
    • http://party-hop.com/uploads/1/3/1/4/131437711/nipadujumegulu.pdf
    • http://motionalvr.com/uploads/1/3/0/6/130639590/rimabudevobinogu.pdf
    • http://motionalvr.com/uploads/1/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fd4.bin
be468e74daa101e67058bd5311b0b6e43b8e96e3021ba14778a18ea9911fd1b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FD4 10848 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.