Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f1c752e22c56863…

MALICIOUS

PDF

47.9 KB Created: 2020-03-27 03:37:49 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e9b328f72627d8f07ab6f195e039a4d5 SHA-1: 5e9cae99017dd049bf9af37e4d8fc6ddc38b48a7 SHA-256: 9f1c752e22c568634363b71652d822676751b386149df6d9623eac8001e8d539
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though malformed, contains references to these URLs, suggesting a deliberate attempt to direct users to external content. The ML classifier also strongly indicated maliciousness. The primary purpose appears to be a link farm, potentially for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://block1949-asu.com/uploads/1/3/0/2/130288883/130288883.html#ejemplos+de+empresas+que+utilizan+business+intelligence+en+chile
    • http://getawayfever.com/uploads/1/3/0/3/130313212/6d44c5b74e.pdf
    • http://tastydairy.club/uploads/1/3/0/5/130588789/97149c8.pdf
    • http://hickoryhillchurch.com/uploads/1/3/0/2/130271016/6417542.pdf
    • http://www.tyningsclimbers.co.uk/uploads/1/3/0/3/130313286/2c526c54d.pdf
    • http://boomcars.de/uploads/1/3/0/2/130272232/4094000.pdf
    • http://theloveofmeraki.com/uploads/1/3/0/7/130776462/bolodax-zamavap-xebupapi-kabapi.pdf
    • http://threesixfivemyanmar.com/uploads/1/3/0/6/130620340/5de6944b1b5018f.pdf
    • http://sharonthelibrarian.com/uploads/1/3/0/5/130551248/pizozoz_pebefuku.pdf
    • http://integrityinsadvisors.com/uploads/1/3/0/4/130435532/kazedotu_tedatigiru.pdf
    • http://brisbanehomemortgagebrokers.com.au/uploads/1/3/0/4/130476912/2862988.pdf
    • http://2614ogleton.com/uploads/1/3/0/3/130323250/afcecf.pdf
    • http://zuriscustomboutique.com/uploads/1/3/1/1/131163538/2a52a86a3.pdf
    • http://oakleighfarmstud.com/uploads/1/3/0/4/130488700/lutemufiloxum_bifajudejinagi_bewekivi_tisenaripow.pdf
    • http://supernaturalconfession.com/uploads/1/3/0/6/130640090/fajorilonuxufi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008d8b.bin
8324b737299b0ed1ebb7fd95cbcd6e2598dbd56bfc20a952016ad282e7dd461f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D8B 9520 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.