Malicious PDF — malware analysis report

Static analysis result for SHA-256 c07af91e9ce3b37d…

MALICIOUS

PDF

54.7 KB Created: 2020-03-30 13:06:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1cb4358adb02e8429dab51610d94cc21 SHA-1: 6bf90ea82059a6c208076204e58c757df99d9264 SHA-256: c07af91e9ce3b37de234d98458ed8d1de28977a5f6f8c3e0fec256da1701f1f6
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to domains that appear to be part of a link farm. The primary URL in the document body, http://74-123-73-235.mgwnet.com/uploads/1/3/1/0/131070695/131070695.html#que+es+la+poblacion+urbana+wikipedia, suggests a lure related to population statistics, likely to disguise the malicious intent. The ML classifier strongly indicates maliciousness, supporting the conclusion that this PDF is designed to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-73-235.mgwnet.com/uploads/1/3/1/0/131070695/131070695.html#que+es+la+poblacion+urbana+wikipedia
    • http://janabakunina.com/uploads/1/3/0/6/130639259/502b250b44322b6.pdf
    • http://higradenc.com/uploads/1/3/0/8/130813796/zobolufemipibapito.pdf
    • http://meyerpaintingcompany.com/uploads/1/3/0/6/130621470/webiru_xibituxixenixa_bijizifiwiji_zuvuwi.pdf
    • http://arkvannoa.be/uploads/1/3/0/4/130493714/dufuro-xiwujok-xatamufimigo.pdf
    • http://behavioralhealthbillingspecialist.com/uploads/1/3/0/8/130874045/6614364.pdf
    • http://craftfoodandwinefestival.com/uploads/1/3/1/4/131407011/9350510.pdf
    • http://joannebrothwell.com/uploads/1/3/0/5/130546153/seporudaporezex.pdf
    • http://londonpottersguild.org/uploads/1/3/0/6/130639581/zeworurubu-zovidul-vukazo.pdf
    • http://redfieldmediamanagement.com/uploads/1/3/0/7/130739007/1b477ee2.pdf
    • http://phillydish.net/uploads/1/3/0/5/130588269/8181520.pdf
    • http://workbirding.com/uploads/1/3/0/6/130639701/zeperi.pdf
    • http://rtaylorbusinessadvisor.com/uploads/1/3/0/5/130590339/6088534.pdf
    • http://blocktalent.com/uploads/1/3/0/8/130814286/zuwobejifegen.pdf
    • http://constructionsupply255.com/uploads/1/3/0/7/130738994/tilexekexuzabifavino.pdf
    • http://personalshoppinglady.com/uploads/1/3/0/6/130603994/rafudasubinavuvulifu.pdf
    • http://literaryloft.com/uploads/1/3/0/9/130969164/2360871.pdf
    • http://radiance-hair.com/uploads/1/3/0/4/130488513/aefcc99c5ce.pdf
    • http://nrgonlinesupport.com/uploads/1/3/0/2/130288522/2680606.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008a3e.bin
c85bd3a1f13acb2331fcc63c944485ede1a95d2e8d54db6e462d9fc7313014de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A3E 9588 bytes
font_01_sfnt_off0000ace2.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0xACE2 2652 bytes
font_02_sfnt_off0000b649.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB649 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.