Malicious PDF — malware analysis report

Static analysis result for SHA-256 a98a86d38a439e60…

MALICIOUS

PDF

45.6 KB Created: 2020-04-02 00:35:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: fef03abd838a7208e3a5400d02c5c0f2 SHA-1: c5f7225e9ce48fc4fe34f08ffa56440f1c14ae4e SHA-256: a98a86d38a439e6023328c7cc1d93a72989e8a61f8ecd93f6d75b1988a86d0d5
116 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to PDF files with numeric slugs, indicative of a link farm or SEO spam tactic. The document body itself contains a question about a Free.fr phone number, which is likely a lure to encourage clicks on the embedded malicious URLs. The primary intent appears to be directing users to potentially malicious websites through these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Macro/content-enable lure medium SE_ENABLE_LURE
    Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://slbconsultingservices.com/uploads/1/3/0/6/130640163/130640163.html#quel+est+le+num%C3%A9ro+de+t%C3%A9l%C3%A9phone+de+la+messagerie+free+%3F PDF link annotation
    • http://customartpresentation.com/uploads/1/3/0/4/130490719/ee818.pdfIn PDF document text
    • http://anotherhunnygoddessproduction.com/uploads/1/3/0/4/130476308/dosigetewori.pdfIn PDF document text
    • http://selfloveinplainsight.com/uploads/1/3/0/5/130543979/zibenupobubavilu.pdfIn PDF document text
    • http://kaylasuzanne.org/uploads/1/3/0/5/130551526/1380459.pdfIn PDF document text
    • http://kristinerinartistry.com/uploads/1/3/0/5/130588307/5935773.pdfIn PDF document text
    • http://katolivares13.com/uploads/1/3/0/4/130477372/wobof.pdfIn PDF document text
    • http://ashevillecarpetcleaning.org/uploads/1/3/0/5/130545643/semefud.pdfIn PDF document text
    • http://picklesedinburgh.com/uploads/1/3/0/5/130538997/408952.pdfIn PDF document text
    • http://nexustempe.com/uploads/1/3/0/5/130543064/zuwikuwimirijujonuno.pdfIn PDF document text
    • http://mixmax.biz/uploads/1/3/0/8/130814024/be3dd9909f0.pdfIn PDF document text
    • http://woodbridgenjplumbers.com/uploads/1/3/0/4/130436204/8949820.pdfIn PDF document text
    • http://metamixis.com/uploads/1/3/0/7/130775388/gotetibufefum.pdfIn PDF document text
    • http://majesticpleasantprairie.com/uploads/1/3/0/7/130739607/742edbfe.pdfIn PDF document text
    • http://listen2alexza.com/uploads/1/3/0/6/130622029/sukuwupumanunijojob.pdfIn PDF document text
    • http://santosmillworkcorp.net/uploads/1/3/0/5/130589299/retarefa-vigoperel.pdfIn PDF document text
    • http://uptownrusticms.com/uploads/1/3/1/3/131383647/8878984.pdfIn PDF document text
    • http://theshoutstorytelling.com/uploads/1/3/0/6/130639960/xamakat.pdfIn PDF document text
    • http://ikankawan.org/uploads/1/3/0/8/130813111/wutujiditigakal.pdfIn PDF document text
    • http://peaceofgloryfounation.com/uploads/1/3/0/7/130738564/7beb03b67844.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000822a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x822A 10068 bytes
SHA-256: a3faa3a91f00659b4cfcf509d8af013cce2e0609de4f719ca6eca71504d13d25

Open this report in the interactive analyzer, or submit your own file for analysis.