Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8e65d229553c7c6…

MALICIOUS

PDF

37.8 KB Created: 2020-05-22 05:43:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-04
MD5: 3bfd63ce6dc6046e293ac707cdad34bd SHA-1: f534ff8757031c1ff391bc54deb5634689b212a1 SHA-256: a8e65d229553c7c676d6bcb03dd7eb1275cc18197b39568106d621406096726c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This suggests a link farm or a method to distribute malicious content indirectly. The document body contains text related to 'Mario and Luigi Superstar Saga rom u', indicating a lure for users searching for game ROMs. No scripts were extracted from this sample. The primary attack pattern involves enticing users to click through a series of links, potentially leading to malware downloads or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lameeplaceholder.devsite-1.com/uploads/1/3/0/2/130271061/130271061.html#mario+and+luigi+superstar+saga+rom+u PDF link annotation
    • http://oldguardtees.com/uploads/1/3/1/8/131857060/nukowasut_miluf.pdfIn PDF document text
    • http://ns1.mitasbakeshop.com/uploads/1/3/1/1/131164250/9476287.pdfIn PDF document text
    • http://thecakebyceci.com/uploads/1/3/0/6/130604259/01b864b3.pdfIn PDF document text
    • http://2017giants.com/uploads/1/3/1/4/131407736/0d1c4f4608f79.pdfIn PDF document text
    • http://alternativehmg.com/uploads/1/3/1/3/131383678/popawiku-ketit.pdfIn PDF document text
    • http://apexbookings.com/uploads/1/3/0/6/130620370/jipowumavike_falosoruwugax_vivomerodun_gitowufibetoza.pdfIn PDF document text
    • http://kokoonmi.fr/uploads/1/3/0/7/130740017/2477953.pdfIn PDF document text
    • http://winkelitemink.com/uploads/1/3/1/4/131454620/8228eaf.pdfIn PDF document text
    • http://cariboustrategies.com/uploads/1/3/1/6/131606624/6bb36eeb.pdfIn PDF document text
    • http://onecrazyraven.com/uploads/1/3/0/4/130476605/df927607de838b.pdfIn PDF document text
    • http://diegojones.com/uploads/1/3/0/6/130621076/mapowasolulava.pdfIn PDF document text
    • http://affectivedevelopment.com/uploads/1/3/0/5/130588492/reluxojil.pdfIn PDF document text
    • http://vildtgaarden.com/uploads/1/3/0/6/130604771/zulafime_muparirupapo.pdfIn PDF document text
    • http://elevatedadventures.com/uploads/1/3/1/6/131606073/4ea24.pdfIn PDF document text
    • http://flcboutique.shop/uploads/1/3/1/3/131379830/3489006.pdfIn PDF document text
    • http://greenhillwinery.info/uploads/1/3/0/4/130436154/4336595.pdfIn PDF document text
    • http://tennisinbusiness.org/uploads/1/3/0/4/130490602/93017d55.pdfIn PDF document text
    • http://nubianessencellc.com/uploads/1/3/1/3/131398157/1151122.pdfIn PDF document text
    • http://fhssoftball.com/uploads/1/3/1/3/131379899/kigojo.pdfIn PDF document text
    • http://doulainhudsonvalleynewyork.com/uploads/1/3/0/6/130604238/2ffca24323f0d.pdfIn PDF document text
    • http://dokkarise.com/uploads/1/3/0/6/130621865/rapunevedub-mopusoxapu.pdfIn PDF document text
    • http://sonicrepair.com/uploads/1/3/0/6/130604180/buzela.pdfIn PDF document text
    • http://heartrates.net/uploads/1/3/1/6/131636957/9395457.pdfIn PDF document text
    • http://duskcollaborative.org/uploads/1/3/0/6/130604612/1e3ef003.pdfIn PDF document text
    • http://wlmproperties.net/uploads/1/3/0/7/130740427/zodufotesok-zimugemuvadod-tibadopolobetig.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006433.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6433 12192 bytes
SHA-256: 9751cac95224657f6ae6e35c46bbc65ed2fa607b96b3f256b85756eeec3f26db

Open this report in the interactive analyzer, or submit your own file for analysis.