PDF static analysis report

Static analysis result for SHA-256 bb27930923eb82af…

SUSPICIOUS

PDF

151.9 KB Created: 2020-04-01 22:53:53 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-08-10
MD5: d40180599471fe6c172a6555ecf43ea6 SHA-1: 776ce0d7130835c4ac76efacd65811337689182f SHA-256: bb27930923eb82afa1f91c42e88ce187071ce735fe5c386398697409dd1f3949
36 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The ML classifier strongly indicated maliciousness in this PDF. The document body contains a deceptive title, 'The art of persona 5 english pdf dow', which is likely a lure to trick users into downloading malicious content. Numerous external URLs were extracted, all pointing to PDF files hosted on various domains, suggesting a distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brigitcallaghan.com/uploads/1/3/1/0/131070602/131070602.html#the+art+of+persona+5+english+pdf+dow PDF link annotation
    • http://troop827.info/uploads/1/3/0/2/130289224/1cc2f6cdd.pdfIn PDF document text
    • http://kreativstueberl.com/uploads/1/3/0/7/130740556/0423d88.pdfIn PDF document text
    • http://myjasonwallace.com/uploads/1/3/0/7/130775506/rulipiro_jamewabi.pdfIn PDF document text
    • http://jerrysrenovationsllc.com/uploads/1/3/0/2/130289610/3766030.pdfIn PDF document text
    • http://claritypsych.com/uploads/1/3/0/7/130739385/9343674d4e815.pdfIn PDF document text
    • http://blandonleung.com/uploads/1/3/0/2/130289185/ef12ee3ad4ec.pdfIn PDF document text
    • http://kilimanjarocottage.com/uploads/1/3/0/6/130604703/03694f041419451.pdfIn PDF document text
    • http://shippingmastersnd.com/uploads/1/3/0/5/130543059/jomipatawalolobemaji.pdfIn PDF document text
    • http://agamirecords.com/uploads/1/3/0/6/130620887/biwafar-kedamamitupilut-kivonow.pdfIn PDF document text
    • http://tasommer.com/uploads/1/3/0/2/130289636/b9461.pdfIn PDF document text
    • http://lukecharlesdavis.com/uploads/1/3/0/3/130313319/lapapugutadero.pdfIn PDF document text
    • http://djaccountingservices.com/uploads/1/3/1/0/131070089/jaxujet.pdfIn PDF document text
    • http://utahdivorceadvisor.com/uploads/1/3/0/6/130639254/velugox.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00017f49.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F49 10032 bytes
SHA-256: 8568adf805ebb9eff3b621be8cb1554daf04374836d1072bc001bc4cbe9640c2
font_01_sfnt_off0001a363.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A363 56456 bytes
SHA-256: e00a94fc40318479067340c2b3b1add3d56cd046b889aff612647cd8667a0fff