Malicious PDF — malware analysis report

Static analysis result for SHA-256 b770a480e6adc359…

MALICIOUS

PDF

54.3 KB Created: 2020-03-29 04:22:03 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 2da99bec91535206b918e845cddc2ecb SHA-1: c26c00a67ef007084c60014dccaf08ffe4010383 SHA-256: b770a480e6adc35945d22ed1673efd2dc8f34faeb61afe4676f5cec51d7966a7
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary URL points to content related to adolescent pregnancy in Honduras, suggesting a lure to draw users to potentially malicious or SEO-manipulated content. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nashobavalleyextractco.com/uploads/1/3/1/3/131397938/131397938.html#consecuencias+del+embarazo+en+adolescentes+en+honduras
    • http://amanda-mccall.com/uploads/1/3/0/6/130604004/8014151.pdf
    • http://rachelscala.com/uploads/1/3/0/4/130488615/b2a3a147e64e3.pdf
    • http://vigilanttool.com/uploads/1/3/0/8/130813643/talalujazan_pozalak_kupasisagowuse_miwulo.pdf
    • http://loyalty.quoconow.com/uploads/1/3/0/7/130775972/010435b54565.pdf
    • http://lenorenorrgard.net/uploads/1/3/0/3/130379627/somutapaxe-jotofo.pdf
    • http://andrewsk-foodadventure.com/uploads/1/3/0/9/130969150/a6ab116fa830ed7.pdf
    • http://4bodyandsole.com/uploads/1/3/0/6/130621344/sosuja.pdf
    • http://easttexasconcrete.com/uploads/1/3/0/5/130539059/tisuri-gofofix.pdf
    • http://kimberlysfarmsflowers.com/uploads/1/3/0/7/130775558/rabureleka_ruwijivuzi_mizobalinidakew_dotofuj.pdf
    • http://druecrookston.com/uploads/1/3/0/5/130589239/1913523.pdf
    • http://soyamore.com/uploads/1/3/0/5/130541004/zaxotepak.pdf
    • http://cinecharal.com/uploads/1/3/0/4/130488414/sitesubesagowowuwele.pdf
    • http://ladsoffthepitch.com/uploads/1/3/0/6/130620468/vapuz.pdf
    • http://sa-nags.org/uploads/1/3/0/4/130490719/9420066.pdf
    • http://www.youngexplorersenrichment.com/uploads/1/3/0/8/130874012/kipagovadufove-guluvide-pigajoga-runit.pdf
    • http://cgi.raleighchamber.org/uploads/1/3/0/6/130605292/09caa3d8c8.pdf
    • http://elusiveobvio.us/uploads/1/3/1/1/131164546/tutap_jibagujed_rapasazipoma_kosopezixa.pdf
    • http://carpetcleaningfw.com/uploads/1/3/0/7/130775244/vodukizopa.pdf
    • http://www.wecleanparkinglotdrains.com/uploads/1/3/0/9/130969824/9097703.pdf
    • http://host73.carmichaelnl.com/uploads/1/3/0/6/130604788/6675492.pdf
    • http://fempowerstartup.com/uploads/1/3/0/9/130969960/2d36994eef3.pdf
    • http://936mulchin.net/uploads/1/3/1/1/131164110/donegodokiba-vodene.pdf
    • http://protutorlearning.com/uploads/1/3/0/4/130494389/3685854.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008aba.bin
f9afe551f3dbe5af00268d238836eb299c09e861ccd39cab9908ac57977e8faf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ABA 8380 bytes
font_01_sfnt_off0000a951.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA951 2616 bytes
font_02_sfnt_off0000b285.bin
313ae97aba67c0290f1f3f711cce73b58f529e1044d09d56103cb5e1641d71c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB285 16232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.