Malicious PDF — malware analysis report

Static analysis result for SHA-256 c0a435d5630dffe3…

MALICIOUS

PDF

140.9 KB Created: 2020-06-12 04:03:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-24
MD5: 01d6b41d7becb4c99c362a030770d553 SHA-1: fcfcf370e03e7fd00961b2d0e3dedc96e32d8439 SHA-256: c0a435d5630dffe34fc8578d73f081d513693d8876006575475afbdf6bdd3a32
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to similarly structured URLs on different domains, suggesting a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains a reference to 'Parliaments of different countries pdf' and a URL that matches one of the extracted external links. This indicates the document's primary purpose is to redirect users to potentially malicious content hosted on these external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9643

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hostmaster.kiloactivewear.com/uploads/1/3/1/0/131070979/131070979.html#parliaments+of+different+countries+pdf PDF link annotation
    • http://parkersphotoart.co.uk/uploads/1/3/0/8/130813999/873546c89e33.pdfIn PDF document text
    • http://theinvestmentsalesgroup.com/uploads/1/3/0/2/130270799/binore-mamekaravuzatu-powapovitewoki-gilasoresitav.pdfIn PDF document text
    • http://mail.saskiateunisse.nl/uploads/1/3/1/4/131411245/9f09c.pdfIn PDF document text
    • http://ohiooutdoorweddings.com/uploads/1/3/0/7/130738797/zusaropexalarov.pdfIn PDF document text
    • http://undercovernetwork.com/uploads/1/3/0/7/130740242/7864329.pdfIn PDF document text
    • http://deltaaviationoxygen.com/uploads/1/3/0/4/130489159/parusada_kolot.pdfIn PDF document text
    • http://cowgirlmeat.com/uploads/1/3/1/4/131437044/44bce.pdfIn PDF document text
    • http://danseicook.com/uploads/1/3/0/4/130483050/tizolukujotu.pdfIn PDF document text
    • http://myetinfo.com/uploads/1/3/0/7/130739026/1625169.pdfIn PDF document text
    • http://obsessedwithcare.com/uploads/1/3/0/4/130493714/1783666.pdfIn PDF document text
    • http://greatrecessframework.org/uploads/1/3/0/3/130323600/acefb8901d7759.pdfIn PDF document text
    • http://cookiecrumbleslimes.com/uploads/1/3/0/8/130814761/mukewo.pdfIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://www.thdl.org/http://www.thdl.org/TibetanIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://gezuduropen419134146.files.wordpress.com/2020/06/jubime.pdfIn PDF document text
    • https://lorujoxomejo.files.wordpress.com/2020/06/fekujeriparu.pdfIn PDF document text
    • https://ritiduka.files.wordpress.com/2020/06/xenagobisa.pdfIn PDF document text
    • https://mudopepomof.files.wordpress.com/2020/06/ravotivevisap.pdfIn PDF document text
    • https://jufovab.files.wordpress.com/2020/06/zakerugatojefosomupiwo.pdfIn PDF document text
    • http://maoz.dss.ucdavis.edu/uploads/1/3/0/6/130639792/xojugugixovod.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text
    • http://www.geocities.com/mitra_anirban/hobbies.htmGNUIn PDF document text
    • http://www.gnu.org/copyleft/gpl.htmRegularIn PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlTibetanIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://scripts.sil.orgIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 10

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off0001ccfa.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1CCFA 26100 bytes
SHA-256: 0bab6dff48bc4fa67c2f45b8e68117a4e3cced4dfdd1bf78fe93383bb160eecc
font_00_sfnt_off0000fd58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD58 10096 bytes
SHA-256: fbb4367c009c0e5ae30423e0d705f0d5976d7a83aae9d5a3ae86a6f1632b3a59
font_01_sfnt_off00011f69.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11F69 4728 bytes
SHA-256: 468e1c180ba9ad0a38d4d43edd18156eb8aec1aff206d1ca26b8d0ee2f899690
font_02_sfnt_off00013073.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13073 4840 bytes
SHA-256: 0d73d740ea58c2c2254eb4e2bad8aa4d58062e2511a738e296f3f7bd3c9a9f9e
font_03_sfnt_off00014050.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14050 12752 bytes
SHA-256: bd6185bdcb2a481bc507425af478e88aa736061fa72544908f90ca156cfbf7e1
font_04_sfnt_off00015d0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x15D0F 7992 bytes
SHA-256: 2b086584b00300d3404db6f1cc65773eb6c20eb97e739ef83f4e57bfa37c8d6f
font_05_sfnt_off0001736a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1736A 8236 bytes
SHA-256: 87ff2501be7e0309a4d2209ea5c26a80fce47ff96d02be5362063d12f35fcbe1
font_06_sfnt_off00018d8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18D8E 24160 bytes
SHA-256: ddb6a08b73fe0ec79b89a52cab69dc84403aaf0ab0f5745fa1abe6bc3b56b1ba
font_08_sfnt_off0001fdfb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1FDFB 4420 bytes
SHA-256: dd6713ed59872f26fbd11551622cd377f653be5c7f9a9af891f68680a979c847
font_09_sfnt_off00020eb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x20EB3 6492 bytes
SHA-256: 84a6efc0dda9f0c2a7f399712c821982fc11cf32f06eb77efdda63d924edde4d

Open this report in the interactive analyzer, or submit your own file for analysis.