Malicious PDF — malware analysis report

Static analysis result for SHA-256 a19751d9d2211bf8…

MALICIOUS

PDF

36.1 KB Created: 2020-04-13 09:08:28 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1120aa66320bb1ae2c18da96b36e80de SHA-1: e9c06f82be502c1b09088d856b2749d3d72f0e48 SHA-256: a19751d9d2211bf88787d686ccca270758550388af3a779a08cfe212cfd3ddbd
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many pointing to other PDF files on different domains, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly flagged this file as malicious. The document body contains a mathematical phrase and application metadata, but the primary malicious activity appears to be the distribution of links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://olivianight.com/uploads/1/3/0/4/130489162/130489162.html#la+suma+de+tres+numeros+consecutivos+pares+es+78
    • http://kathleencrisp.com/uploads/1/3/0/7/130739662/2733011.pdf
    • http://markruffolo.net/uploads/1/3/1/3/131380944/4065501.pdf
    • http://livingrichnow.net/uploads/1/3/1/4/131453918/166fa5.pdf
    • http://piercepartnershipgroup.com/uploads/1/3/0/8/130814914/davatizun.pdf
    • http://urbanstones.net/uploads/1/3/1/4/131438151/kadigow.pdf
    • http://wbinvestigations.net/uploads/1/3/1/4/131406892/721333d021.pdf
    • http://eventurouspresents.com/uploads/1/3/1/3/131382030/5bf05f.pdf
    • http://hobusarealty.net/uploads/1/3/1/3/131384260/diremofoku-jiloju-rudewi-getokoruf.pdf
    • http://alifecarenursingagencyandstaffing.com/uploads/1/3/0/6/130604243/15c693b1.pdf
    • http://bearnecessitiesworkshop.com/uploads/1/3/1/3/131383297/3731316.pdf
    • http://shopatwestparksc.com/uploads/1/3/1/3/131384636/bd39adb.pdf
    • http://countrygardensga.net/uploads/1/3/0/7/130738501/7817778.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000055bb.bin
260772627b7977cf186a5e4947052e200c86a201cdf6a7034cc92abb3d01c54a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55BB 8652 bytes
font_01_sfnt_off000074d5.bin
885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74D5 4144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.