Malicious PDF — malware analysis report

Static analysis result for SHA-256 b03ede64f73818d2…

MALICIOUS

PDF

37.4 KB Created: 2020-03-29 04:38:00 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 8ff86ecf27d018fd8236f5ae1a756f8f SHA-1: 9302dcfca30042b5468b895e8df2fe8ef1f7c821 SHA-256: b03ede64f73818d2742b006a928d8a8382ea37cb04615db79ece12f59b63c526
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a launch action that directs the user to an external URL, disguised with content related to coloring pages. It also exhibits a PDF SEO link farm pattern, embedding numerous external links to other PDF files. This suggests a campaign focused on driving traffic or distributing further malicious content through a network of compromised or controlled domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Launch action high PDF_LAUNCH
    PDF contains a /Launch action with an unresolved or extension-less target — treat as potentially dangerous
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-75-235.mgwnet.com/uploads/1/3/0/7/130775628/130775628.html#imagenes+de+letras+para+colorear PDF link annotation
    • http://buildingbiodiversity.club/uploads/1/3/0/4/130489185/jekiruke.pdfIn PDF document text
    • http://randomlyincoherent.com/uploads/1/3/0/5/130551129/9f794caa.pdfIn PDF document text
    • http://mesorasyisrael.org/uploads/1/3/0/7/130738863/soraj_puloxowovasobej.pdfIn PDF document text
    • http://lloydlindseyproperty.com/uploads/1/3/0/4/130475980/f381de7e.pdfIn PDF document text
    • http://www.litnerdcurriculum.com/uploads/1/3/0/7/130739510/5192152.pdfIn PDF document text
    • http://torontorealestateconsultants.com/uploads/1/3/0/9/130969588/manune.pdfIn PDF document text
    • http://macksnack.com/uploads/1/3/0/5/130550769/verujagonitil-jodebizo.pdfIn PDF document text
    • http://meetonhorn.com/uploads/1/3/0/2/130288600/2a1d23deeb4a8.pdfIn PDF document text
    • http://instituteforpolicecoaching.com/uploads/1/3/1/1/131164174/3fceb0b7c5e01f3.pdfIn PDF document text
    • http://commonwealth-designs.com/uploads/1/3/0/6/130639115/lagex_devanefoxozew.pdfIn PDF document text
    • http://mta-sts.mail.hwy24.org/uploads/1/3/0/5/130550847/poruwev.pdfIn PDF document text
    • http://dallascoco.com/uploads/1/3/0/2/130291544/8323828.pdfIn PDF document text
    • http://fullcircledentalllc.com/uploads/1/3/0/4/130436127/dexiv.pdfIn PDF document text
    • http://launch-baby.com/uploads/1/3/0/8/130874222/tusuxidolob_nivijeke.pdfIn PDF document text
    • http://artfarmgraphics.com/uploads/1/3/0/5/130589050/pebefetafo_linepizaxujez_litizoseb.pdfIn PDF document text
    • http://stacysfoundation.org/uploads/1/3/0/7/130775102/fed7959e.pdfIn PDF document text
    • http://amandajeanereichert.com/uploads/1/3/0/5/130541346/4981324.pdfIn PDF document text
    • http://cpanel.ngabwe.com/uploads/1/3/0/5/130550926/8935271.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b9c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6B9C 7744 bytes
SHA-256: f1a517bfbc3696034906f8bbfa8b06d6dcc2f06ea92bbcb107fe8fe21ec86945

Open this report in the interactive analyzer, or submit your own file for analysis.