PDF malware analysis — malicious · b45e4fed2f7f7756

MALICIOUS

PDF

44.6 KB Created: 2020-04-11 03:15:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: fdf9d2c43aeab8accb3030786c75a12c SHA-1: 501b99404770655f0e58a99ce5ecfc3664b43a27 SHA-256: b45e4fed2f7f77566754dba16fab7608834aefbad56c6c781f53b9d27360cf3b

94 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a significant number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. One of these links, http://74-123-75-152.mgwnet.com/uploads/1/3/0/6/130639540/130639540.html#stand+by+me+doraemon+%282014%29+hindi+dubbed, is directly embedded in the document body. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern appears to be directing users to a network of linked sites, likely for SEO spam or to host further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL

The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://74-123-75-152.mgwnet.com/uploads/1/3/0/6/130639540/130639540.html#stand+by+me+doraemon+%282014%29+hindi+dubbed
- http://vastgoedstyling-decoathome.com/uploads/1/3/0/6/130604259/7129b0899c.pdf
- http://maizenandmolloy.com/uploads/1/3/0/3/130324050/c860efb77.pdf
- http://napacountylac.com/uploads/1/3/1/0/131071117/5898235.pdf
- http://kowbiemedia.com/uploads/1/3/1/3/131379194/2020371.pdf
- http://middleschooltechtalk.com/uploads/1/3/0/3/130323422/pofadi.pdf
- http://prouni2024.com/uploads/1/3/0/5/130539035/d00da6a04a.pdf
- http://post-productie.be/uploads/1/3/0/4/130476594/maxodoxofin_ranulesumaxuz.pdf
- http://jcpdrywallllc.com/uploads/1/3/0/4/130489023/nijel.pdf
- http://allieplatt.com/uploads/1/3/0/7/130739349/lejalov_nabojilifomoba_tudefif.pdf
- http://gforcedrafting.com/uploads/1/3/1/4/131482957/ximuf-sitowejikoxu-gemime.pdf
- http://likolovebites.com/uploads/1/3/0/6/130621011/darifisedefak.pdf
- http://modish716.com/uploads/1/3/0/9/130969086/milubavurila.pdf
- http://secondchancebeauties.com/uploads/1/3/0/5/130588357/wilomanile-kuzileniduwof-vivafosofopigad.pdf
- http://lowtoasthockey.com/uploads/1/3/0/4/130436224/zulugekaku_xejime.pdf
- http://vastgoedstyling-decoathome.com/uploads/1/3/0/6/130604259/7129
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007485.bin` `0bb7ae8c43aab95e675599e17a0f426cd82bcf2c3e4bf0701391e570ff51a83e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7485	8436 bytes
`font_01_sfnt_off000094b3.bin` `f0eb0a3fc03e8f1a38978b3220dbdb9dfd671fe44ef39d2d5f720d3ac67400e6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x94B3	5224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.