Malicious PDF — malware analysis report

Static analysis result for SHA-256 bedbe52dc4f53935…

MALICIOUS

PDF

40.1 KB Created: 2020-04-01 17:18:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f238edcb4b36889d4500e365679a2e06 SHA-1: f5fce18f25b5bda7ad77915c63822f463f7571bc SHA-256: bedbe52dc4f5393534ddcc648b46c491a0821ab96a8311921e07e2544c860e52
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are numerically or generically named PDFs hosted on various domains. This pattern is indicative of a link farm or SEO manipulation tactic, designed to drive traffic to potentially malicious or low-quality content. The ML classifier strongly supports the malicious nature of this PDF. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://belserenterprise.com/uploads/1/3/1/4/131482894/131482894.html#como+citar+entrevistas+en+una+bibliografia
    • http://tukeinternationalconsulting.com/uploads/1/3/0/2/130289313/1203277.pdf
    • http://alyaqtha.com/uploads/1/3/0/7/130775778/54770ae.pdf
    • http://hkjourneys.net/uploads/1/3/0/6/130604397/27240.pdf
    • http://fixitrightcomputing.com/uploads/1/3/0/7/130738946/b6c387a05537.pdf
    • http://water-vibe.com/uploads/1/3/1/0/131070001/53db0cb5d336.pdf
    • http://datasimplicitylabs.com/uploads/1/3/0/4/130476652/foxofinolukevilurag.pdf
    • http://pcflooringplus.com/uploads/1/3/0/7/130739383/jetavu-gemaj-rewuzomitenoni-zuzuguj.pdf
    • http://ds4all.tech/uploads/1/3/0/5/130550681/kimunenegakiv.pdf
    • http://msportsix.com/uploads/1/3/0/6/130639753/lavanivivasukemoga.pdf
    • http://525cottagelane.com/uploads/1/3/0/6/130639571/31e2b44ca14.pdf
    • http://enmassepodcast.com/uploads/1/3/0/6/130603810/bedodojuk-wumizilet-jukitaxit-zodupebiwusu.pdf
    • http://dove-beauty-sophia.com/uploads/1/3/0/6/130621349/70a1e16d3e0.pdf
    • http://bamboobydesign.com/uploads/1/3/0/6/130639603/gilegujiwenom.pdf
    • http://gcgg.me/uploads/1/3/0/2/130272516/joxuwitewudo.pdf
    • http://fischerconsultingsolutions.com/uploads/1/3/0/7/130738861/fb8e84581.pdf
    • http://leadgencoaching.com/uploads/1/3/0/6/130639327/23ce4.pdf
    • http://nancytangles.com/uploads/1/3/0/7/130775905/1874318.pdf
    • http://calaepi.org/uploads/1/3/0/5/130541064/xupej_sepumoxogaxuf_zufuridog_dajajilikipo.pdf
    • http://broadwaystationeyecare.com/uploads/1/3/0/5/130550827/bukedixozivaxuwilob.pdf
    • http://lesviviersdelocker.com/uploads/1/3/0/6/130604198/ketazesidipemoga.pdf
    • http://biblewitnessministries.com/uploads/1/3/0/4/130436439/7754518.pdf
    • http://3piecebikini.com/uploads/1/3/0/6/130604958/paluwexe-salaperuruj.pdf
    • http://docwhaler.com/uploads/1/3/0/5/130546977/600b4f9a70c4b6.pdf
    • http://pegasuspercussion.com/uploads/1/3/0/6/130604476/newemuwefozaxixerom.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071be.bin
b75fe869851ef3dbd893f153d835e38a3c1f4f18dcb6a35d0f32b3462b9e009d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71BE 8528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.