Malicious PDF — malware analysis report

Static analysis result for SHA-256 95b19830fb22ecbf…

MALICIOUS

PDF

46.4 KB Created: 2020-04-11 00:22:13 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e0aeeb9496cdb5a434dd95da284f117d SHA-1: d77200db27b959f4933565c426a1ea9e4a59d5e4 SHA-256: 95b19830fb22ecbf5c63a261cac18a0e199b9659e48b80f158ee58c7e15823cd
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged by a machine learning classifier as malicious. It contains a large number of external links, many of which point to PDF files on various domains, suggesting a link farm or SEO manipulation tactic. One of the extracted URLs is http://corustest.devsite-1.com/uploads/1/3/0/2/130291589/130291589.html#leo+buscaglia+living+loving+and+learning+quotes. The document body contains metadata about its creation, but no explicit lure text. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://corustest.devsite-1.com/uploads/1/3/0/2/130291589/130291589.html#leo+buscaglia+living+loving+and+learning+quotes
    • http://etoneworks.com/uploads/1/3/0/6/130620923/5198684.pdf
    • http://luminarydesigns.shop/uploads/1/3/1/4/131407083/3d70b8103b.pdf
    • http://artisaneducation.org/uploads/1/3/1/3/131398053/4844898.pdf
    • http://lavonvanwilliams.com/uploads/1/3/0/2/130291646/gavipanisudamas_milapa_wowim_mipakozu.pdf
    • http://theevenbetterlife.com/uploads/1/3/0/5/130551006/nosesaxuzi.pdf
    • http://harris-rankin.com/uploads/1/3/0/2/130289641/fubavu.pdf
    • http://shrugrepublic.com/uploads/1/3/0/4/130488476/9603856.pdf
    • http://personalreligion.net/uploads/1/3/1/3/131381519/juzijovowezon.pdf
    • http://chirokate.com/uploads/1/3/0/7/130738542/mipotizosewor.pdf
    • http://moragacounseling.com/uploads/1/3/0/7/130775952/livikixupuli.pdf
    • http://buythebookswla.com/uploads/1/3/1/4/131454500/fexumupim-zonedururetigu-nexeribexiwogo-jatefiretavaki.pdf
    • http://magik-cleaning.com/uploads/1/3/0/4/130490561/3654660.pdf
    • http://trhillcrimson.com/uploads/1/3/0/5/130588168/2033570.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000081b3.bin
2ab9987d0859800b5e7e4958a0b9ee6f6e85f83bc062886df4ce0452d45d1ba4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81B3 9756 bytes
font_01_sfnt_off0000a38f.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA38F 2596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.