Malicious PDF — malware analysis report

Static analysis result for SHA-256 a9abf02f537bc884…

MALICIOUS

PDF

48.2 KB Created: 2020-05-18 18:07:09 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: d53698b9f39a1541706c647f7f917dd6 SHA-1: 74a8c95f8547f7b1675e44e9c65a1dd86e4275b0 SHA-256: a9abf02f537bc88412c12edc0f435b21344dfac88b489113d730638a923f549f
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, mentions 'Costco cake order form 2016', suggesting a lure. The primary function appears to be directing users to a network of websites, likely for malicious purposes such as phishing or malware distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jdpentertainment.net/uploads/1/3/0/4/130477775/130477775.html#costco+cake+order+form+2016
    • http://precisionautosalesllc.com/uploads/1/3/0/5/130590261/f13cf35a2.pdf
    • http://highnetworthyou.com/uploads/1/3/0/5/130544063/wedolasuzo_wufevo_duwulajola.pdf
    • http://sheaandaloe.com/uploads/1/3/1/6/131606186/genasotagijapiv_xilumuredob_jukemexikudinab.pdf
    • http://needahouse.net/uploads/1/3/0/3/130323216/afe17b5330b.pdf
    • http://ytfco.com/uploads/1/3/0/6/130603828/dujezug-zafulotefi-dumarone-sabaxutugub.pdf
    • http://maintenantici.com/uploads/1/3/0/8/130874102/1914971.pdf
    • http://immigrationpartnersofamerica.com/uploads/1/3/0/6/130621388/wofatonupukivure.pdf
    • http://zenvalleyyoga.com/uploads/1/3/0/8/130814788/sapof_pajefososive_rolifereb_rixat.pdf
    • http://bouquetbuffetllc.com/uploads/1/3/0/8/130874029/reniru-ripexa.pdf
    • http://wetware.international/uploads/1/3/1/4/131452817/padimiwifo.pdf
    • http://walkmedford.com/uploads/1/3/1/6/131606279/1596800.pdf
    • http://blockmountings.com/uploads/1/3/1/4/131438419/4148565.pdf
    • http://confessionsofablendedfamily.com/uploads/1/3/1/6/131606807/92fe2d30f3d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000078e7.bin
d3e66b4035d97d735c53fe6713e5c98a69caf4c73dd3fdbf204a213c6baf9ab1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x78E7 11332 bytes
font_01_sfnt_off00009fad.bin
028dbaa76d48ae99b02248bacea50134e27ed131f5dd39e25ac401de8961e19b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9FAD 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.