Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1437a05019f364a…

MALICIOUS

PDF

51.5 KB Created: 2020-03-22 10:55:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-12-25
MD5: df0600a2f27d6b277ab466095133bd7b SHA-1: db1e8cf90c3c9346efc9a7fc00402a63c962d7d1 SHA-256: c1437a05019f364a1a449ac256d4a1159b9cee4717aaf56f88810c1425ce9133
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, characteristic of a link farm designed to manipulate search engine rankings or distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious linking behavior. The document body itself is largely unreadable, but the presence of the URL 'http://asociacionperiodistaspr.org/uploads/1/3/0/6/130639073/130639073.html#ecuaciones+pendulo+de+torsion' suggests a potential lure related to academic or technical content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asociacionperiodistaspr.org/uploads/1/3/0/6/130639073/130639073.html#ecuaciones+pendulo+de+torsion PDF link annotation
    • http://kellietaylor.com/uploads/1/3/0/5/130590363/390d81e9ffb.pdfIn PDF document text
    • http://www.litfriendscandles.com/uploads/1/3/0/6/130622106/9d807dff.pdfIn PDF document text
    • http://secondaire1et2.net/uploads/1/3/0/5/130588572/fugodefa.pdfIn PDF document text
    • http://ballroomalliance.com/uploads/1/3/0/6/130639462/libenizipe-kavexon-nuxovu.pdfIn PDF document text
    • http://just-plane.com/uploads/1/3/0/6/130620209/muzirolowolubik-rovimetanuz-fusuvizatapak.pdfIn PDF document text
    • http://biblewordstudy.org/uploads/1/3/0/7/130776169/0251124cb05d11e.pdfIn PDF document text
    • http://telegraphhillart.com/uploads/1/3/0/5/130589276/b9dbe49.pdfIn PDF document text
    • http://www.heatherraenorthway.com/uploads/1/3/0/5/130588244/zalovo.pdfIn PDF document text
    • http://mmalifestyler.com/uploads/1/3/0/7/130739185/rexuxinanani.pdfIn PDF document text
    • http://myfinlandlimerence.com/uploads/1/3/0/5/130544468/pomavono.pdfIn PDF document text
    • http://autodiscover.goddessrockstararts.com/uploads/1/3/1/0/131070302/sutozudo_zenesekew_narozi_duzowipes.pdfIn PDF document text
    • http://basementband.com/uploads/1/3/0/7/130738790/5701182.pdfIn PDF document text
    • http://strmopus.com/uploads/1/3/0/6/130621473/vebinurevikagunoz.pdfIn PDF document text
    • http://klinmasterservices.org/uploads/1/3/0/5/130589077/6675216.pdfIn PDF document text
    • http://cloakanddaggerdc.com/uploads/1/3/0/2/130272364/xonufedurix_mirabulezes_neteze_popef.pdfIn PDF document text
    • http://drjamesdhagen.com/uploads/1/3/0/2/130289775/8e1a24afb.pdfIn PDF document text
    • http://www.trilogytradingco.com/uploads/1/3/0/5/130588199/319e9056c.pdfIn PDF document text
    • http://muskegonapostolic.com/uploads/1/3/0/5/130589209/sorida.pdfIn PDF document text
    • http://el046.elrepco.com/uploads/1/3/0/8/130874396/gifadupiz-panenaxasilivu-felunopev-pikowofe.pdfIn PDF document text
    • http://impacteconomics.org/uploads/1/3/0/5/130539315/a9607.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007913.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7913 9256 bytes
SHA-256: efae9870d3211149408da03373d285c3e0f489a0648da92f307e8b644d089b0b
font_01_sfnt_off00009ab9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9AB9 4032 bytes
SHA-256: 8410a9b0a648253946d0031cf5116477b3b2d65d9037521ba717657ac5248867
font_02_sfnt_off0000a84e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA84E 16240 bytes
SHA-256: 52b2a21cabd9f37596538e94a10de0fa26fb144581f03c766fbf8d88063a306a

Open this report in the interactive analyzer, or submit your own file for analysis.