Malicious PDF — malware analysis report

Static analysis result for SHA-256 bb48a2f9ac3f1ffd…

MALICIOUS

PDF

69.2 KB Created: 2020-03-20 15:50:13 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: 05af45949bce6db8a16146cd99af6680 SHA-1: e6889836915b9f1838c52b1bfbacb6688966ad97 SHA-256: bb48a2f9ac3f1ffdb0a4c79954d05e4ba17e7d440544155c5665f8f54300f7f4
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO spam technique, likely intended to drive traffic to malicious or low-reputation sites. The document body itself contains metadata related to its creation by wkhtmltopdf and a search query, suggesting it was generated to appear as a search result. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://f10athletics.com/uploads/1/3/0/7/130776585/130776585.html#dimensiones+del+aprendizaje+marzano+pdf PDF link annotation
    • http://mamu.ca/uploads/1/3/0/8/130813510/ff8dc9bd983a.pdfIn PDF document text
    • http://synergyelitekratom.com/uploads/1/3/0/3/130313557/50e00a7b8c5.pdfIn PDF document text
    • http://legacy-thrift.com/uploads/1/3/1/0/131070938/vegibekaji_kasug_madiralono_lomutiz.pdfIn PDF document text
    • http://easlinstitute.org/uploads/1/3/0/6/130639852/ef4a7b486d5a.pdfIn PDF document text
    • http://campbellslittleloads.com/uploads/1/3/0/5/130541103/e8e4601.pdfIn PDF document text
    • http://carlpires.com/uploads/1/3/0/6/130604336/mobipebigiro-wijidulomo-xisabodewu.pdfIn PDF document text
    • http://adrianoconnor.com/uploads/1/3/0/5/130588511/gusaninemazidado.pdfIn PDF document text
    • http://spartanssouthlafc.org/uploads/1/3/0/5/130543064/4049961.pdfIn PDF document text
    • http://orangecountybestpressurewashing.com/uploads/1/3/0/6/130604612/jigibivov.pdfIn PDF document text
    • http://ebdoproperties.com/uploads/1/3/0/6/130605122/1055425.pdfIn PDF document text
    • http://brandranker.com/uploads/1/3/0/8/130874366/2cd6e1653.pdfIn PDF document text
    • http://beccaandbill.com/uploads/1/3/0/7/130739143/1978827.pdfIn PDF document text
    • http://321markets.com/uploads/1/3/0/6/130604640/modezuwijipa.pdfIn PDF document text
    • http://ashleyberendphotography.com/uploads/1/3/0/4/130483474/jaxagilixov_zerokivo.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e431.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE431 9288 bytes
SHA-256: 82444918342f0469cbe282d7a51f7c1be8f4f2fb64fc501f2e73b13485f791ee

Open this report in the interactive analyzer, or submit your own file for analysis.