Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b450fba6d3fd117…

MALICIOUS

PDF

49.4 KB Created: 2020-03-29 10:52:21 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-07
MD5: 9f05ba1c681ec22604b049bccc476ef8 SHA-1: d79a78648a081addf771e6504203f24ddc074d3c SHA-256: 9b450fba6d3fd117ec3b37cba8d169169eb12b253ef47135ec1979ad308c86e6
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous links to external websites, presented as a "link farm" for SEO purposes. The document body explicitly mentions downloading a game, and the embedded URLs lead to PDF files hosted on various domains, suggesting a phishing or malware distribution attempt. The ML classifier strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hotelvic-phase2-ko.devsite-1.com/uploads/1/3/0/7/130775199/130775199.html#download+game+dragon+ball+z+budokai+tenkaichi+3+pc+rar PDF link annotation
    • http://bccbuckscountycornhole.com/uploads/1/3/0/4/130476396/dipebaxitix_fafawakig_valozadabevitu.pdfIn PDF document text
    • http://krasser-andreas.com/uploads/1/3/0/6/130604169/wufit.pdfIn PDF document text
    • http://mindfulnessforeveryone.com/uploads/1/3/0/5/130539215/digadixonu.pdfIn PDF document text
    • http://neweramovementllc.com/uploads/1/3/0/9/130969533/1842033.pdfIn PDF document text
    • http://attorneymarkanderson.com/uploads/1/3/0/2/130272485/gilenamuril-goveguvos.pdfIn PDF document text
    • http://mta-sts.mail.manheimtouchdownclub.com/uploads/1/3/0/4/130436242/netaziti.pdfIn PDF document text
    • http://chicagocbdsurvey.com/uploads/1/3/0/3/130323161/7ed84.pdfIn PDF document text
    • http://autodiscover.virginiabaptistscommitted.org/uploads/1/3/0/8/130813399/wamalu.pdfIn PDF document text
    • http://highlifemarijuana.com/uploads/1/3/0/6/130639750/675738.pdfIn PDF document text
    • http://ocumoney.com/uploads/1/3/0/5/130551006/kagugufe_jivew_rawonisowazija.pdfIn PDF document text
    • http://woodstreamga.com/uploads/1/3/0/7/130776295/zivax.pdfIn PDF document text
    • http://carlsongracieencinitas.com/uploads/1/3/0/8/130813616/gaguluzonim_rureti_verufabaw.pdfIn PDF document text
    • http://teampowerelectric.com/uploads/1/3/0/5/130551597/3206ca2fdf8f9c.pdfIn PDF document text
    • http://shared-insight.com/uploads/1/3/0/2/130273872/8149170.pdfIn PDF document text
    • http://pushthenote.com/uploads/1/3/0/8/130814576/lenebuxopolomiwosol.pdfIn PDF document text
    • http://revelationsmagazine.com/uploads/1/3/0/6/130640172/vomixubanefezed.pdfIn PDF document text
    • http://noukapab2.com/uploads/1/3/0/2/130288426/ziditujarezela.pdfIn PDF document text
    • http://bonitolson.com/uploads/1/3/0/2/130270826/9244520.pdfIn PDF document text
    • http://insitepropertymanagement.net/uploads/1/3/0/6/130639160/nazuw.pdfIn PDF document text
    • http://london-pet-grooming.co.uk/uploads/1/3/0/2/130292014/zekeja.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008014.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8014 9180 bytes
SHA-256: 2e6d8380aab3ae23cabc1a8abd7693340b3d08eb2c9efd72b7f24cccec7281b4
font_01_sfnt_off0000a282.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA282 6408 bytes
SHA-256: 8d17431ef57e68df5a12c688c561c816e2bf4da9e9402592eb5a9506436888c7

Open this report in the interactive analyzer, or submit your own file for analysis.