Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad2176f5b764cfd9…

MALICIOUS

PDF

51.2 KB Created: 2020-03-08 09:46:42 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 4863061bd0399705317c447d89c3f3b2 SHA-1: 2a33f2ffa7427b52fc10377ebf0d12fe8284069e SHA-256: ad2176f5b764cfd9f36fea5a31d621a758699ca97bdf7de6a43e03adf22f399b
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are SEO-optimized and point to PDF files on various domains. This technique is often used to distribute malicious content or redirect users to phishing sites. The presence of a link farm heuristic strongly suggests this is the primary malicious function. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/2/130288643/130288643.html#autoimmune+hepatitis+aasld+guidelines+2017 PDF link annotation
    • http://www.bluesteelradio.com/uploads/1/3/0/6/130604025/6700506.pdfIn PDF document text
    • http://www.voiceoveranna.com/uploads/1/3/0/5/130539114/3276452.pdfIn PDF document text
    • http://ecotherapyspirituallounge.com/uploads/1/3/0/3/130380037/susibigoruvesumigi.pdfIn PDF document text
    • http://www.newlifedestination.com/uploads/1/3/0/9/130969991/2547349.pdfIn PDF document text
    • http://www.richmondcoworking.com/uploads/1/3/0/6/130639559/4273001.pdfIn PDF document text
    • http://neuface.net/uploads/1/3/0/2/130271045/fobejasepuwabovotemi.pdfIn PDF document text
    • http://www.rachelunbound.com/uploads/1/3/0/5/130544826/1699312.pdfIn PDF document text
    • http://homeintergration.com/uploads/1/3/0/9/130969658/eb73c53f35.pdfIn PDF document text
    • http://josephina.ballerina.com/uploads/1/3/0/5/130539059/dexenosidavuvinuvuw.pdfIn PDF document text
    • http://www.dellxl.org/uploads/1/3/0/4/130483354/fa322a.pdfIn PDF document text
    • http://sanjosedelosreynoso.com/uploads/1/3/0/2/130272242/4208756.pdfIn PDF document text
    • http://djsacademy.com/uploads/1/3/0/6/130640072/xakivabovazojubon.pdfIn PDF document text
    • http://gabrielkane.com/uploads/1/3/0/8/130813818/4668728.pdfIn PDF document text
    • http://optimusbusiness.net/uploads/1/3/0/7/130776687/7f7e0242a4af8.pdfIn PDF document text
    • http://shop.missabellahousekeeping.com/uploads/1/3/0/2/130287930/dumesezema_lukitabivifun_razuzorod.pdfIn PDF document text
    • http://www.osborgoflove.com/uploads/1/3/0/2/130287269/301bf73b30.pdfIn PDF document text
    • http://www.fdceducatorsnsw.com/uploads/1/3/0/2/130272973/rikonarinofezed.pdfIn PDF document text
    • http://indigorealms.com/uploads/1/3/0/6/130639183/d9dd99d010.pdfIn PDF document text
    • http://naturesedge-fl.org/uploads/1/3/0/5/130540604/0961d3a5d.pdfIn PDF document text
    • http://mta-sts.mail2.hauntedhousetour.com/uploads/1/3/0/3/130379431/galatedozodezij-wekibed-nibeliv.pdfIn PDF document text
    • http://anastasiaosho.com/uploads/1/3/0/6/130639842/zutelitonaduxod.pdfIn PDF document text
    • http://georgwebbtogo.com/uploads/1/3/0/6/130620961/2cf4642d.pdfIn PDF document text
    • http://steveslawnmowersales.com/uploads/1/3/0/3/130313037/667dae955ffa.pdfIn PDF document text
    • http://grovetennislessons.com/uploads/1/3/0/5/130550800/pejoli.pdfIn PDF document text
    • http://palletwrapz.net/uploads/1/3/0/4/130494636/magopewinof.pdfIn PDF document text
    • https://doi.org/10.1002/hep.31065In PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009983.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9983 10284 bytes
SHA-256: c568828af4764a1920f8a472a096c083ad3f30976752f902a5b046375e0350fc

Open this report in the interactive analyzer, or submit your own file for analysis.