Malicious PDF — malware analysis report

Static analysis result for SHA-256 95b94bcbe66c29ab…

MALICIOUS

PDF

32.7 KB Created: 2020-06-22 04:52:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1da2f6d4b68a9d7e097d0fbc8fe3fbfc SHA-1: 213e740f502452a7cf3bbdba657068fd64ee47a6 SHA-256: 95b94bcbe66c29ab0ab2eda73fbdf995ab85cdf3b7a658afb17431248d6480f8
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, indicating a link farm or SEO spamming attempt. The ML classifier strongly flagged this PDF as malicious. The document body, though heavily obfuscated, contains references to a 'math study guide' and numerous URLs, reinforcing the lure and redirection strategy. No scripts were extracted, but the sheer volume of outbound links suggests a high likelihood of malicious redirection or content hosting.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rmifoundry.com/uploads/1/3/0/6/130639821/130639821.html#aims+math+study+guide
    • http://oroshaziingatlan.com/uploads/1/3/0/7/130738950/da2da210ab15b65.pdf
    • http://mx.originalkennel.com/uploads/1/3/0/3/130323461/fabax.pdf
    • http://adan.pt/uploads/1/3/1/4/131437623/4798051.pdf
    • http://designsouthernstyle.com/uploads/1/3/1/1/131163955/1df564e510.pdf
    • http://nwweatlhbuilder.com/uploads/1/3/0/4/130483592/d2b2874c1cb21.pdf
    • http://childrensartfoundation.com/uploads/1/3/0/6/130604874/salubegodiros_jukikuj_wegijuf_domor.pdf
    • http://thecustomcaninekitchen.com/uploads/1/3/1/8/131856096/lawituxo-bufokufupaporin-sezajisake.pdf
    • http://mta91.qualitynow.net/uploads/1/3/0/6/130620667/94980d29175.pdf
    • http://woodlandwindllc.com/uploads/1/3/0/6/130621805/mubefajopilejeritefi.pdf
    • http://hostmaster.equineintelligence.co.uk/uploads/1/3/0/4/130490019/8b91cefc1abb.pdf
    • http://makego.fi/uploads/1/3/0/6/130621197/8016487.pdf
    • https://member.mathhelp.com/api/auth/?token=
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045aa.bin
58362fd14d0c1d2191cc2a8f5305795569477a0543eaef8147d04b905dd2bbc7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45AA 4868 bytes
font_01_sfnt_off00005635.bin
5cb743bab084d90cada1174f3815abecefc77e55bcfd14f8d85e96d9c8eba0cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5635 9568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.