Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2711d4b05201024…

MALICIOUS

PDF

43.3 KB Created: 2020-03-31 19:27:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f6469f383642cf955e4d8f6415cadd2c SHA-1: fef2a6cf3fbd032826c8d85301fb3d38720b5cfd SHA-256: a2711d4b052010249246be916a353499d53af20a27449d5353edaf5b8c83f17c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, many of which are numerically or generically named PDFs hosted on unrelated domains. This pattern is indicative of a link farm or SEO manipulation tactic, designed to drive traffic to potentially malicious sites. The ML classifier strongly supports the malicious verdict, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cinderellascleaningcompany.com/uploads/1/3/0/2/130289668/130289668.html#formula+excel+si+mayor+que+y+menor+que
    • http://noahsarkma.org/uploads/1/3/0/4/130476866/5263022.pdf
    • http://scahistoricalsociety.com/uploads/1/3/0/6/130621457/nisakawiki_faxixugopaterab_segokudaluwalez.pdf
    • http://recoveryspecialistsamsterdam.com/uploads/1/3/0/7/130776539/1006769.pdf
    • http://coconutgrovemassage.com/uploads/1/3/0/7/130776818/xotesiguxubizumu.pdf
    • http://signature-xpressions.com/uploads/1/3/0/4/130489776/7664842.pdf
    • http://vantagepointds.com/uploads/1/3/0/7/130739663/visokogifoz.pdf
    • http://sassysandraboutique.com/uploads/1/3/0/5/130550885/mufawowafaniv-titeposuwazuli.pdf
    • http://elcuyolacasadelritmo.com/uploads/1/3/0/2/130287537/9139329.pdf
    • http://emeraldstarcomics.info/uploads/1/3/0/5/130540176/9864257.pdf
    • http://nationalregroup.org/uploads/1/3/0/2/130274097/7303216.pdf
    • http://lifeseminary.us/uploads/1/3/0/4/130488812/najalok.pdf
    • http://ghettiart.com/uploads/1/3/0/7/130775883/92c4d73d4bbd5.pdf
    • http://iamcarpentry.org/uploads/1/3/0/7/130739655/77c39aed7.pdf
    • http://fortheloveofriding.com/uploads/1/3/0/5/130547576/wadaxutonitubuwuniw.pdf
    • http://elephantvox.com/uploads/1/3/0/7/130738735/1cdb2f469ce.pdf
    • http://thepaintersperspective.com/uploads/1/3/0/6/130639733/519185.pdf
    • http://jessicaipresley.com/uploads/1/3/0/6/130621928/5a9aee10236.pdf
    • http://www.jessicajoy.com/uploads/1/3/1/3/131378850/zifogofin.pdf
    • http://mendingkids.net/uploads/1/3/0/2/130289569/6770099.pdf
    • http://sanando.mx/uploads/1/3/0/6/130604327/tawekitajamo_sijole.pdf
    • http://ms1uk.org/uploads/1/3/0/6/130621369/mavamadamagazane.pdf
    • http://intransglobaldexterity.org/uploads/1/3/0/4/130435780/1456646.pdf
    • http://authorradio.com/uploads/1/3/0/2/130272470/3bd1e8.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007a9c.bin
c489d692726242fbe56c7a7e410ec23e48c4f8556e9524edd43584d41b0ca10c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A9C 9572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.