PDF malware analysis — malicious · a6b26c27c594efa2

MALICIOUS

PDF

77.6 KB Created: 2020-05-20 19:04:12 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: fdc1c93b040f151d8213165b6a26e008 SHA-1: 9c3566e16441d766c122e446b45ab0c58ba8a729 SHA-256: a6b26c27c594efa2c90bedd70f74eecc54bcc9e378eebd976f344781acbfe16a

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO poisoning attack. The document body mentions 'Banana fish manga completo pdf', likely a lure to attract users. The ML classifier strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9992

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://niffianva.com/uploads/1/3/0/9/130968912/130968912.html#banana+fish+manga+completo+pdf
- http://yournewbffs.com/uploads/1/3/1/6/131637150/5195694.pdf
- http://emeraldleaf.ca/uploads/1/3/0/6/130621800/9975328.pdf
- http://sharonmckeown.com/uploads/1/3/0/6/130639822/14239cb70c5c7.pdf
- http://skillcraftdefense.com/uploads/1/3/1/8/131856040/596f12e045.pdf
- http://chevy-silverado-1500-4wd-with-z71.com/uploads/1/3/0/6/130621334/8524746.pdf
- http://famousamosphotography.com/uploads/1/3/1/0/131070847/larobuzizisemi.pdf
- http://construccionesengeneral.com/uploads/1/3/1/4/131414019/kukusisi_kotozugomek.pdf
- http://justinetomala.org/uploads/1/3/0/3/130324331/a2b6a5.pdf
- http://potionsnlotions.com/uploads/1/3/0/8/130874060/dd038ecb1.pdf
- http://iwantfreebitcoin.com/uploads/1/3/1/6/131637306/ceac9537f.pdf
- http://ascenthawaii.net/uploads/1/3/0/4/130436390/gijan-jaxepanozigigez-waminu-famesupos.pdf
- http://kakadakhornblogs.com/uploads/1/3/1/3/131380564/vojedir-fipalisulewep-jativezejibofuk.pdf
- http://strongheartpowerteam.com/uploads/1/3/1/0/131070080/xafunalu_sanufetix_mujamodilib_tapib.pdf
- http://changecanberra.com/uploads/1/3/0/4/130488114/6723919.pdf
- http://joseph-apparel.com/uploads/1/3/0/6/130620510/1d42fae19b2b2ad.pdf
- http://nusgss.org/uploads/1/3/1/4/131407818/zojug.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_002_off000090a8.bin` `2f5f8b5d15f6ea370fc3359c12035e126854cb17ac56937cdc4347b923082200`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0x90A8	36180 bytes
`font_01_sfnt_off000101d9.bin` `203d8fd589b6c6ba319d2f96fb90e324b536345f14f0b81ad1040cc5a8510795`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x101D9	13036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.