Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6e7734b7d2964f9…

MALICIOUS

PDF

72.8 KB Created: 2020-06-05 05:15:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-24
MD5: 027c73b5198b9788b37a93e80ce01edb SHA-1: 82dc5e45aea9dc2470d8f9d7784ae1c0ec61e50b SHA-256: a6e7734b7d2964f9a541ff3a02e273c4204cb0d231389cfbcb5698d2323acf4a
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to domains that appear to be part of a link farm designed to host malicious content. The document body, though heavily obfuscated, contains references to URLs that are likely used to redirect users to these malicious sites. The presence of a 'link farm' heuristic and numerous unknown reputation URLs strongly suggests a malicious intent to drive traffic to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xinquanxunwangxinbao2wangzhi.br3h.com/uploads/1/3/1/4/131407876/131407876.html#onigiri+leveling+guide PDF link annotation
    • http://helendear.org/uploads/1/3/1/4/131453950/11fa071c5e78476.pdfIn PDF document text
    • http://jwesleyward.com/uploads/1/3/1/8/131857631/5ebc4a0.pdfIn PDF document text
    • http://kvcllc.net/uploads/1/3/0/5/130551303/cc378ea3.pdfIn PDF document text
    • http://laughingpigtheatre.org/uploads/1/3/0/9/130969082/lufifud.pdfIn PDF document text
    • http://11thhourtravel.com/uploads/1/3/0/9/130969818/7006776.pdfIn PDF document text
    • http://eckelevents.com/uploads/1/3/1/4/131437421/tobugez-niteke-womiluninevase-mofowenikulu.pdfIn PDF document text
    • http://jabbathehuttbutt.com/uploads/1/3/1/4/131407802/zinozaxo.pdfIn PDF document text
    • http://lobecktaylor.org/uploads/1/3/0/6/130620581/9536226.pdfIn PDF document text
    • http://nishkarshcoaching.in/uploads/1/3/1/3/131383921/migodesunusil.pdfIn PDF document text
    • http://taylorbuiltga.com/uploads/1/3/0/4/130488851/2758369d1d3d8d2.pdfIn PDF document text
    • http://xinquanxunwangxinbao2wangzhi.br3h.com/uploads/1/3/1/4/131407876/terms.htmlIn PDF document text
    • http://xinquanxunwangxinbao2wangzhi.br3h.com/uploads/1/3/1/4/131407876/dmca.htmlIn PDF document text
    • http://xinquanxunwangxinbao2wangzhi.br3h.com/uploads/1/3/1/4/131407876/policy.htmlIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://wigasoxela.files.wordpress.com/2020/06/dekapidixarekamuzer.pdfIn PDF document text
    • https://tupuxuw.files.wordpress.com/2020/06/lewib.pdfIn PDF document text
    • https://moniliwi.files.wordpress.com/2020/06/30978987493.pdfIn PDF document text
    • https://sanolosu.files.wordpress.com/2020/06/xijog.pdfIn PDF document text
    • https://difimedo.files.wordpress.com/2020/06/89541573321.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000985c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x985C 21252 bytes
SHA-256: 08e30d282ff4cc556d0aa7da12e83aaaa7d7d29919cca5aa020b2137305fbc9a
font_01_sfnt_off0000db1a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB1A 11136 bytes
SHA-256: e1bfea61019dffcba586b1bafb8b3a86afcedf39520068850945b968346c3451
font_02_sfnt_off0001015c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1015C 16132 bytes
SHA-256: 29a60492f44b39d68fa00197234d6df9a0cf581d74754725da64c153577ac146

Open this report in the interactive analyzer, or submit your own file for analysis.