Malicious PDF — malware analysis report

Static analysis result for SHA-256 99065ef937aaecd0…

MALICIOUS

PDF

34.7 KB Created: 2020-03-21 15:24:58 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: eeac8c6b50317ce32c48ef73acd29318 SHA-1: 5ad0c849851a199e3e9f2d9dbb64fd392df3ef89 SHA-256: 99065ef937aaecd08cc61d7c12a338ca99a6c5e65fc8468247efb89c2499d2e8
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, identified as a PDF link farm. The ML classifier strongly indicates maliciousness. The document body contains obfuscated text and references to 'caribou coffee oakdale mn', likely a lure. The primary attack pattern involves redirecting users to a network of SEO-optimized PDF files hosted on numerous domains, suggesting a traffic redirection or content-serving scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jewelryhavenbynikkispaparazzi.com/uploads/1/3/1/1/131164250/131164250.html#caribou+coffee+oakdale+mn
    • http://westendbarbershop.com/uploads/1/3/0/4/130478347/todegap-lavawolivur-mofegokasowan.pdf
    • http://www.itbuilddocs.com/uploads/1/3/0/7/130739986/namak.pdf
    • http://huntedhome.com/uploads/1/3/0/6/130620380/5a0f0b8fb9a0f.pdf
    • http://atheeralwabel.com/uploads/1/3/0/4/130476447/pimozokumo_bazujagomib_tegenakakudu.pdf
    • http://el-gusto.eu/uploads/1/3/0/7/130775646/jojiwexid.pdf
    • http://cupcakesandaliens.com/uploads/1/3/0/8/130813934/dejesaxizabexujudef.pdf
    • http://jij.net/uploads/1/3/0/4/130489168/depat-zutiwakesube-fisimutawav.pdf
    • http://naturalmedicine4children.com/uploads/1/3/0/2/130291712/2b79a5d36027a.pdf
    • http://fitbythebay.com/uploads/1/3/0/6/130621857/301fa2d966350ee.pdf
    • http://surprisescorpionsaz.com/uploads/1/3/0/2/130273983/xubifuxewuxeko-kuzej-xedonoto.pdf
    • http://mta-sts.mail.whitneyelliottphotography.com/uploads/1/3/0/2/130288421/9f245c6.pdf
    • http://mx.sgbc.net/uploads/1/3/0/2/130271035/1296424.pdf
    • http://cornwallcbt.com/uploads/1/3/0/5/130551441/joxukisakakapid_bibesuxulemo_xigojawelamape_sabimawujiwodix.pdf
    • http://fretworkpublications.com/uploads/1/3/0/2/130271067/b4bb7f0c3e.pdf
    • http://gamemasterj.com/uploads/1/3/0/7/130739073/8470521.pdf
    • http://accelseed.com/uploads/1/3/0/3/130379912/posajiwabig.pdf
    • http://umotivemove.com/uploads/1/3/0/6/130621330/3583753.pdf
    • http://rf-consultora.com/uploads/1/3/0/7/130739333/lunupujubabasar_gogom_janazolepis_kokug.pdf
    • http://weeblee.net/uploads/1/3/0/9/130969235/6085481.pdf
    • http://ahmedfoods.net/uploads/1/3/0/4/130483494/ae31577a86f.pdf
    • http://kingdrylining.com/uploads/1/3/0/5/130541817/f79b1b288d5e5ae.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000604f.bin
aee5394f4775e11ad9dc39ac7d130968574e2d4851115e427176712bf42016b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x604F 7460 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.