Malicious PDF — malware analysis report

Static analysis result for SHA-256 c120e7af114fab2b…

MALICIOUS

PDF

46.7 KB Created: 2020-03-29 12:56:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 29b2dec0d5448a06a8d1b19d932d3a1f SHA-1: 1aae8e37de2e4500b551c23df299292f2b8aa0b1 SHA-256: c120e7af114fab2b81945dbe294e7a700086e016e00486acead795a0d201e27c
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are numerically or generically named PDFs hosted on various domains. The document body text, though partially corrupted, includes a URL that appears to be a lure for users interested in watch settings. This suggests a link farm or SEO poisoning technique to distribute malicious content or conduct phishing. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://colddiamnd.com/uploads/1/3/0/2/130271041/130271041.html#how+to+set+date+on+casio+watch+f-91w
    • http://commercialleasenegotiation.net/uploads/1/3/0/6/130639474/1923390.pdf
    • http://fidicevalo.be/uploads/1/3/1/1/131164164/dujutigonuti-kigunepo-ferijarinojidiz-dujoxawuzisefid.pdf
    • http://gyt-tours.com/uploads/1/3/0/8/130874015/a70f33ad.pdf
    • http://jefro-invest.com/uploads/1/3/0/8/130873741/4492191.pdf
    • http://hazelandbluecandles.com/uploads/1/3/0/3/130312944/loxeboki.pdf
    • http://hssconsultingandconstruction.com/uploads/1/3/0/5/130551342/de9cdecbc2.pdf
    • http://bubadii.com/uploads/1/3/0/9/130969728/6679123.pdf
    • http://tans2toes.com/uploads/1/3/0/6/130604229/sajuxajudijop_pemifedo.pdf
    • http://grace-mind-body.com/uploads/1/3/0/5/130544257/fujar.pdf
    • http://healthyhomesindex.com/uploads/1/3/0/4/130436207/7015226.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076c6.bin
602aa49ef71ff81a1d782dd12e8237f06bf3134047c880cdabf33e0349e0ffc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76C6 9080 bytes
font_01_sfnt_off0000992b.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x992B 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.