Malicious PDF — malware analysis report

Static analysis result for SHA-256 95872024b1de595f…

MALICIOUS

PDF

51.0 KB Created: 2020-04-05 08:46:02 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e2a00983b07fa62ca455c2c083c9513f SHA-1: c5a489e7a5226f94afc2189b18e4a169a4a43259 SHA-256: 95872024b1de595f6f49be7152bbbe8a96e8d53f9882225712604fea7e98b0d1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of external links to other PDFs hosted on various domains, indicative of a link farm or SEO poisoning attack. The ML classifier strongly flagged this PDF as malicious. The document body contains a seemingly innocuous title about dreams, likely a lure to disguise the malicious intent of directing users to a network of potentially malicious or spam-related content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dancinggoatsanctuary.com/uploads/1/3/0/8/130813705/130813705.html#que+significa+ratones+en+un+sue%C3%B1o
    • http://realestatesolutionshome.com/uploads/1/3/1/4/131437813/4496103.pdf
    • http://ascqualityinnovations.com/uploads/1/3/0/4/130483368/majavafafegezewe.pdf
    • http://funeral-booking.com/uploads/1/3/1/3/131379510/xozipisititej-vivedodatizot.pdf
    • http://vbchildrensmuseum.com/uploads/1/3/0/5/130541656/giluxipufud_xemomaso_zasopozoki_radenukuneto.pdf
    • http://kghypnobirthingsouth.com/uploads/1/3/0/2/130289262/502278bb.pdf
    • http://tfllocal.com/uploads/1/3/0/6/130639600/sinina_neladimoj_buxitasiwosu_pugow.pdf
    • http://khaterahparwani.com/uploads/1/3/0/6/130620237/661e6f24ea.pdf
    • http://fameuschocolate.com/uploads/1/3/1/0/131070560/3708903.pdf
    • http://elccauction.com/uploads/1/3/0/5/130590208/xileg.pdf
    • http://crpaintllc.com/uploads/1/3/0/6/130620555/6936652.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d93.bin
5278024270de67705d3a5034a26ce2f5e1d9e53f50705cc770b2190155f81e7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D93 6728 bytes
font_01_sfnt_off00007e36.bin
3e66823fa72ed31801a243612848bcd9fd6f7d6e00ba31e96fe334e6d1a569ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E36 7916 bytes
font_02_sfnt_off00009b30.bin
5fc96ba0b63fca0701aaf47b897c61d33f58fc9de7e57d0134bcfa7fa968dfe5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B30 2804 bytes
font_03_sfnt_off0000a72d.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA72D 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.