Malicious PDF — malware analysis report

Static analysis result for SHA-256 c078959f88a2c740…

MALICIOUS

PDF

67.3 KB Created: 2020-03-27 11:09:54 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: c8c33fccffd121c2eb4c250654de4240 SHA-1: 1f5eb5ac89100b05773b7fafc17ad10dbfab2127 SHA-256: c078959f88a2c740c6d3284267b83b80f08a1ab76ee98cfe699cbe4c3c9ece0a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly indicated maliciousness. The document body contains text related to 'Estetica de arte moderno' and mentions the wkhtmltopdf generator, suggesting a potential lure or disguise. The primary attack pattern involves directing users to numerous external URLs, likely for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deborahsnider.com/uploads/1/3/0/5/130540406/130540406.html#estetica+de+arte+moderno PDF link annotation
    • http://carolinaopticalbluffton.com/uploads/1/3/0/4/130435574/lasezaletale.pdfIn PDF document text
    • http://jhoannaroa.com/uploads/1/3/0/6/130639114/5174082.pdfIn PDF document text
    • http://biodisasterlearningcenter.com/uploads/1/3/0/6/130639267/lezubofi_dibiju_bifogukujago_dizojirix.pdfIn PDF document text
    • http://ncve-taiwan.net/uploads/1/3/0/4/130483682/6cce25bb0c8531.pdfIn PDF document text
    • http://simplespanishonline.com/uploads/1/3/0/3/130313531/peluwomekekatifaruxa.pdfIn PDF document text
    • http://sacfskitchener.com/uploads/1/3/0/4/130436068/zuxogiramu-ziras.pdfIn PDF document text
    • http://nadiacorson.com/uploads/1/3/0/7/130739268/cfe33505.pdfIn PDF document text
    • http://morganvarn.com/uploads/1/3/0/4/130483737/f92ca.pdfIn PDF document text
    • http://radiantrebelcollective.com/uploads/1/3/0/7/130775827/973294.pdfIn PDF document text
    • http://giftedandcreative.org/uploads/1/3/0/7/130739930/9198716.pdfIn PDF document text
    • http://fartlyfe.com/uploads/1/3/0/5/130551046/fobipadelakutalav.pdfIn PDF document text
    • http://powergeardrums.com/uploads/1/3/0/5/130588614/fekevi.pdfIn PDF document text
    • http://newreb.com/uploads/1/3/0/7/130776791/5370112.pdfIn PDF document text
    • http://mail.allthingsginamarie.com/uploads/1/3/0/9/130969678/muzibazitefun_nakegowid_matufekilizomum.pdfIn PDF document text
    • http://urbancampusresources.com/uploads/1/3/0/6/130639471/matosapelidivu_daparatogab_rokaza.pdfIn PDF document text
    • http://sassybikinis.net/uploads/1/3/0/3/130379431/2271307.pdfIn PDF document text
    • http://abreanutrition.com/uploads/1/3/0/2/130270761/3017043.pdfIn PDF document text
    • http://houstonsteinway.net/uploads/1/3/0/6/130620694/zanasegeluxagujer.pdfIn PDF document text
    • http://mx.psuwisconsin.org/uploads/1/3/0/7/130775511/xifazizaro.pdfIn PDF document text
    • http://www.nuzhenofis.ru/uploads/1/3/0/6/130604036/linatutajizawunowo.pdfIn PDF document text
    • http://badbananaclothing.com/uploads/1/3/0/4/130483572/puwom.pdfIn PDF document text
    • http://masterofthedomains.com/uploads/1/3/0/5/130551962/3898152.pdfIn PDF document text
    • http://leahchang.ca/uploads/1/3/0/5/130539311/vazag.pdfIn PDF document text
    • http://llyster.com/uploads/1/3/0/4/130435649/buniruj.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b905.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB905 10360 bytes
SHA-256: 9c54b489a518f64ba19189330a90f3e883c29d6251bad7083ee8a0e4983483a2
font_01_sfnt_off0000ddb2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDDB2 2652 bytes
SHA-256: e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc
font_02_sfnt_off0000e719.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE719 16208 bytes
SHA-256: f304d5248de4d2d535e11e5a3f00133999c598ccb7ee943f2677ab784214679d

Open this report in the interactive analyzer, or submit your own file for analysis.