Malicious PDF — malware analysis report

Static analysis result for SHA-256 a863fd154ebd0bf6…

MALICIOUS

PDF

87.8 KB Created: 2020-03-10 10:12:22 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ce7e9eb60d3c3d1571e9b51595c18e11 SHA-1: cbcb3d29030d826122c0cd7ba0b6b8dd263b2c89 SHA-256: a863fd154ebd0bf6eb553e5c43f7b910d785216fc455a66a72df87113b4a4900
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links pointing to other PDFs, characteristic of a link farm designed for SEO manipulation or to host malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. The document body text is heavily obfuscated and contains embedded URLs, further supporting the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://glebl.bpmtc.com/uploads/1/3/0/5/130588751/130588751.html#eid+ki+namaz+ka+tarika+in+hindi
    • http://mouseandcastle.ca/uploads/1/3/0/6/130639406/dapuvuputi.pdf
    • http://pracin.com/uploads/1/3/0/6/130639593/kivavinizupami-sarejaxinutof-nazijotexe-lujufajazelobo.pdf
    • http://geras.sk/uploads/1/3/0/7/130776814/44903098062e.pdf
    • http://jessicabrowndesign.com/uploads/1/3/0/4/130483923/sutib.pdf
    • http://morethansoulfood.com/uploads/1/3/0/2/130287257/xebipofotikikenipem.pdf
    • http://rockersandrollers.com/uploads/1/3/0/6/130605159/zosujako.pdf
    • http://birgitmachtinger.com/uploads/1/3/0/6/130603832/1244072.pdf
    • http://33135center.com/uploads/1/3/0/8/130874360/9988667.pdf
    • http://www.maryfcarruthers.com/uploads/1/3/0/6/130604878/bozezevumiwujizop.pdf
    • http://tesny.site/uploads/1/3/0/3/130324037/4030087.pdf
    • http://arcc06quebecmetropolitain.com/uploads/1/3/0/3/130313525/bogube-pewerug-monixajivazu.pdf
    • http://mail.breederseed.com/uploads/1/3/0/6/130620778/bifixapivikofe.pdf
    • http://northforkinfo.net/uploads/1/3/0/7/130775503/1500642.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e49f.bin
45123723b5ac0995c23a6c794e54827310ab047edf31e6fc78b664731786b89c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE49F 6256 bytes
font_01_sfnt_off0000fd98.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD98 1388 bytes
font_02_sfnt_off00010536.bin
d71621eb3bff8ac6942496ac6d5049f6da1a7d3b19ff66b7601d0e45ae01c893		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10536 16144 bytes
font_03_sfnt_off00011a2e.bin
45217e6fee0cb984a86132db5cf08ccd9c045786f931f8a80e08da439b10efbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A2E 19140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.