Malicious PDF — malware analysis report

Static analysis result for SHA-256 93dcdb61753049fc…

MALICIOUS

PDF

40.5 KB Created: 2020-03-22 07:04:00 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d09dd226a953a2d6f7632354f494db1e SHA-1: 765b7bace8031f28849769a968f4db24757f58f6 SHA-256: 93dcdb61753049fc0ca0bc99db746cbf63e188ed3acd504b2fac240528fa3f28
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML classifier also strongly indicated maliciousness. The document body text, though partially corrupted, contains a URL that is also present in the list of extracted URLs, reinforcing the link-hosting nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beingself-centered.com/uploads/1/3/0/2/130287895/130287895.html#recipes+using+hershey%27s+special+dark+chocolate+bar
    • http://hostmaster.celebratingcurves.co.uk/uploads/1/3/0/9/130969353/b29ed63d14b41.pdf
    • http://88massmotors.com/uploads/1/3/0/8/130874095/nawesa-linerowuvopen-gimasobo.pdf
    • http://ttyulechengquaomen.br3h.com/uploads/1/3/0/6/130620715/juzovikife_midajutawaselix_tedusemakupexin.pdf
    • http://www.fresnoguttercleaning.com/uploads/1/3/0/7/130739379/gajisamabefe.pdf
    • http://webmail.marketingaz.com/uploads/1/3/0/8/130815115/mofepixavafupo.pdf
    • http://forestgraphic.com/uploads/1/3/0/6/130622106/27c59cca828c.pdf
    • http://www.app.myremio.com/uploads/1/3/0/4/130436272/sidogak-dosirola-nagijolidubiv-xugujejirozi.pdf
    • http://www.onlineinvest.dadgifts.us/uploads/1/3/0/5/130543772/41de135.pdf
    • http://oceanviewchristian.com/uploads/1/3/0/4/130488834/10cccc3a1.pdf
    • http://sjcchamilton.org/uploads/1/3/0/4/130488884/kesapewerodedijin.pdf
    • http://greatguesses.com/uploads/1/3/0/6/130604962/zilusedapewodaz-dudeta-noxuxaxegidilet.pdf
    • http://minimaldatayang.com/uploads/1/3/0/8/130815311/9382459.pdf
    • http://hartmando.org/uploads/1/3/0/3/130313445/4427816.pdf
    • http://chatterlabs.com/uploads/1/3/0/4/130488382/b96aa2d49ee7eae.pdf
    • http://webdisk.tobiasholm.dk/uploads/1/3/0/7/130775265/jupivededafugemak.pdf
    • http://hostmaster.viviamoilmontalbano.it/uploads/1/3/0/5/130590139/4713391.pdf
    • http://www.grandblancmusic.com/uploads/1/3/0/7/130776218/julizujomupox.pdf
    • http://theburrowclub.com/uploads/1/3/0/2/130272442/e1347d2833.pdf
    • http://jsmythwordpressdesigns.club/uploads/1/3/0/2/130271043/21b6dbfcce757.pdf
    • http://loftbyaspuces.com/uploads/1/3/0/8/130874318/9afacd113d47027.pdf
    • http://hairbyzari.com/uploads/1/3/0/6/130639036/8724321.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007241.bin
26631a96a7e352037e245c07b4d585dc028ade3f817c994c9b60a641969984c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7241 8896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.