Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0488ce8fb314f0e…

MALICIOUS

PDF

64.9 KB Created: 2020-03-29 22:34:42 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 35cfe5437fcfc372bfb5f66b87a9665b SHA-1: 6fb0659f9a6c7bbae3cdc5ec5fb77508eae7dc42 SHA-256: b0488ce8fb314f0e57929a213d5f334d4816035d3d7a0072ddb671269d20ecd5
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged by an ML classifier as malicious. It contains a large number of external links, a technique often used for SEO spam or to distribute further malicious content. The document body itself contains garbled text and references to 'Ejercicios de poleas resueltos 2 eso', suggesting a lure to disguise the malicious intent. The primary attack pattern involves directing users to a vast farm of external PDF links hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lennoxweb.com/uploads/1/3/0/9/130969879/130969879.html#ejercicios+de+poleas+resueltos+2+eso
    • http://tntlive.net/uploads/1/3/0/3/130379365/85bd3.pdf
    • http://instantestimates.services/uploads/1/3/0/5/130539846/bemunedexasomi.pdf
    • http://shicongying.com/uploads/1/3/0/5/130547418/dd2981864bd5963.pdf
    • http://wikibonresearch.com/uploads/1/3/0/7/130739233/34e421b4d2d87b7.pdf
    • http://irresistibleselflove.com/uploads/1/3/0/4/130435638/doraja.pdf
    • http://impactfoc.com/uploads/1/3/0/2/130289700/d5ad10e723.pdf
    • http://oregonizdlivingtoday.com/uploads/1/3/0/6/130639100/jazodiwunukez.pdf
    • http://myacollective.com/uploads/1/3/0/4/130476407/bupoxinejavukebege.pdf
    • http://alanareinamusic.com/uploads/1/3/0/5/130544303/4823713.pdf
    • http://inhomesolutions.es/uploads/1/3/0/5/130550859/satirupa-karogotab.pdf
    • http://nutramin.be/uploads/1/3/0/5/130547624/jezonudojep.pdf
    • http://takenwithtahoe.com/uploads/1/3/0/4/130483271/2068367.pdf
    • http://esppdx.com/uploads/1/3/0/7/130739614/xoviminit-vukar-bisem-jomip.pdf
    • http://webdisk.fujifilmreviews.com/uploads/1/3/0/2/130289515/putowidezotutosekufo.pdf
    • http://bushwoodbuilders.com/uploads/1/3/0/5/130590482/13ef4558.pdf
    • http://lockeaizen.com/uploads/1/3/1/3/131383251/fofuwotivavovukagur.pdf
    • http://faithfullyfitdaily.com/uploads/1/3/0/7/130739206/4fc1b7.pdf
    • http://savethemiddleriver.net/uploads/1/3/0/5/130540134/1de3cafabe400d5.pdf
    • http://onlinemarketingmastermindgroup.com/uploads/1/3/0/3/130323403/ccb376103a2d.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b313.bin
ff080a5d27d3137a963d38b38880712fa5933cf07a0c4b9ec7ff6819f4557e5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB313 9136 bytes
font_01_sfnt_off0000d448.bin
37f5452301c093781c3d8370804b6f3f52cfdb8a2d7b415f708f676045b90d93		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD448 2732 bytes
font_02_sfnt_off0000ddfa.bin
14447e2a50ebb47b5dc8f7088a6530a987d81829484995d9fa02feadd50f830e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDDFA 16112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.