Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c79ea96ea075234…

MALICIOUS

PDF

64.3 KB Created: 2020-03-11 03:57:01 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ccbe4ba17a28cccbed82f10c5ebb33d6 SHA-1: fa71c585f8d84130b1464c88f06b4c0eee9e9d56 SHA-256: 9c79ea96ea075234c4b294a9fd4cd1811e72842d21a81ba057548c45feea7f2b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, many of which follow a pattern indicative of a link farm or SEO abuse. The document body, though heavily obfuscated, contains text related to 'Atrial fibrillation guidelines 2019 acc', suggesting a lure to disguise the malicious intent. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a large number of external URLs, likely to host further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://qpd6s6.bdgct.com/uploads/1/3/0/8/130874122/130874122.html#atrial+fibrillation+guidelines+2019+acc
    • http://sonsetministries.com/uploads/1/3/0/4/130491513/456a4411.pdf
    • http://colonialcpchurch.org/uploads/1/3/0/4/130476688/7b7429.pdf
    • http://tiffanyhdesign.com/uploads/1/3/0/6/130605048/lapenipizuk.pdf
    • http://nextlevelmortal.com/uploads/1/3/0/6/130604557/5522171.pdf
    • http://happy-cam.com/uploads/1/3/0/6/130604161/410a8e86f1979.pdf
    • http://desatascosgava.net/uploads/1/3/0/5/130543289/boximivale.pdf
    • http://nhbea.com/uploads/1/3/0/5/130589158/moduzokiw.pdf
    • http://mountainzonewaterpolo.com/uploads/1/3/0/6/130604366/4646238.pdf
    • http://smartscalestech.com/uploads/1/3/0/7/130739260/681376.pdf
    • http://kelseyhopebrewer.com/uploads/1/3/0/4/130436173/vekuxexikig.pdf
    • http://ginamaethejones.com/uploads/1/3/1/0/131070940/3167986.pdf
    • http://www.surreycarpetcleaner.ca/uploads/1/3/0/5/130545087/054e58d7a46d.pdf
    • http://www.38zeros.com/uploads/1/3/0/8/130813714/1201075.pdf
    • http://siddibio.com/uploads/1/3/0/6/130621279/virexijigafej.pdf
    • http://triadfootandankleassociates.com/uploads/1/3/0/3/130379163/713132.pdf
    • http://www.questbusinesses.com/uploads/1/3/0/5/130588567/2194a2e.pdf
    • http://bodysagespa.com/uploads/1/3/0/4/130493389/jiligufe.pdf
    • http://consplayers.com/uploads/1/3/0/6/130604557/8596433.pdf
    • http://ccandleco.com/uploads/1/3/0/6/130639231/bdfe1b891b4f.pdf
    • http://beatricecloakefineart.com/uploads/1/3/0/6/130604091/xufabezoluburu-tediwofinin.pdf
    • http://ultimatemartialartsusa.com/uploads/1/3/0/6/130605390/luvijixepo.pdf
    • http://accountinghoustontexas.com/uploads/1/3/0/6/130639922/sawuzopunix_nigoxuwinebovun_kekuzuvavogipo.pdf
    • http://bpacontractorsme.com/uploads/1/3/0/7/130738499/rodesagezu.pdf
    • http://www.whitefoxaccessories.com/uploads/1/3/0/6/130621084/7529df363.pdf
    • http://www.mxsnot.com/uploads/1/3/0/2/130271080/zufanogima.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000bda4.bin
44c9908d97dee86c9dbba7d59e8de16810fcae19b22e6e7f925206a99e557785		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBDA4 8304 bytes
font_01_sfnt_off0000dd96.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD96 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.