Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7c47e920f18fbcb…

MALICIOUS

PDF

58.6 KB Created: 2020-05-24 03:43:39 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 33345015c54166a47e77fe12d1c6a8ff SHA-1: ce083a6b3336c139527789b56d570a2e9cef83d6 SHA-256: b7c47e920f18fbcb3d019ca59db44a71e88d4fb7db81bb0aafd37a7118fe7a0c
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier strongly flagged this PDF as malicious, supporting the suspicious nature of the numerous external links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://awayugo.voyagerwebsites.com/uploads/1/3/0/4/130436058/130436058.html#bp+driver+rewards+promo+code+2017
    • http://vcreformasyserviciosintegrales.com/uploads/1/3/1/6/131606366/bekon.pdf
    • http://itechcomputing.com/uploads/1/3/0/5/130551137/3111262.pdf
    • http://cwworkshops.com/uploads/1/3/1/0/131070938/lazixarelod_nofexozekod.pdf
    • http://thedolphinboat.com/uploads/1/3/1/3/131378943/24269bc61.pdf
    • http://theniamarie.com/uploads/1/3/0/5/130551230/fiwapigurevaxawoz.pdf
    • http://nopressureapparel.net/uploads/1/3/0/5/130540280/839323.pdf
    • http://barefootsup.us/uploads/1/3/1/8/131872146/gurifadusemejaduvuz.pdf
    • http://abovealltravelagency.com/uploads/1/3/1/4/131454238/jupumatexexonuniza.pdf
    • http://jd-cars.com/uploads/1/3/0/9/130969139/21c094f54.pdf
    • http://veteransforlife.net/uploads/1/3/0/7/130739431/tasuvelukew.pdf
    • http://sundaysatfourva.org/uploads/1/3/1/6/131637342/vegor.pdf
    • http://mail.wapasbeautysalon.com/uploads/1/3/0/4/130489051/3cd054.pdf
    • http://wendyfwilliams.net/uploads/1/3/0/3/130313577/zosokeguwularir_sopivivab.pdf
    • http://coastalhunter.com/uploads/1/3/1/3/131379553/09505c8d15.pdf
    • http://ldovemanagementllc.com/uploads/1/3/0/4/130491322/c89ca3.pdf
    • http://derekbeckvold.com/uploads/1/3/1/4/131407922/5093909.pdf
    • http://liveyourdreamtour.com/uploads/1/3/0/4/130488251/balew_pevanaleka.pdf
    • http://brainshower.consulting/uploads/1/3/0/6/130639792/zedivokuxipuvejenad.pdf
    • http://thegingerbreadgroup.com/uploads/1/3/0/2/130289335/56adb017b35.pdf
    • http://lizbusch.com/uploads/1/3/0/7/130775119/keram_rokixupiwadalo_likusel_meledoreset.pdf
    • http://rockpaperpirate.com/uploads/1/3/0/6/130639933/pogem.pdf
    • http://confidentpassionatewoman.com/uploads/1/3/1/4/131437530/4172eb42d3.pdf
    • http://rsdconsultingllc.org/uploads/1/3/0/3/130379379/bilawevelisana-labigosamotofu-wewududeviwef-tuwopupej.pdf
    • http://latticeworkinvestments.com/uploads/1/3/0/2/130287937/kedususixunerapi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009bb3.bin
60739542d2304f43ace18ab2f1966558647493770ad73ea0f36a103c1e239525		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BB3 14264 bytes
font_01_sfnt_off0000c8b5.bin
c988415812f594187b0a0ed75dc52802e798e1695b49bd300f8412a65040a449		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC8B5 16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.