Malicious PDF — malware analysis report

Static analysis result for SHA-256 c3e3c11178c4b034…

MALICIOUS

PDF

49.4 KB Created: 2020-03-22 09:24:20 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-08-25
MD5: 7a50f8f0e944519bfd654a000a679d2a SHA-1: d4e584392e3bc3c0fbda9c2c8d5cf2f8f2b1c49a SHA-256: c3e3c11178c4b0342b49de59ef86989021aef74e9b1cda9c8ed850e0c5e357ad
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF document employs a link farm technique, embedding numerous external links to other PDF files. The document body text, though corrupted, suggests a lure related to 'Sql server query pdf free download'. The primary heuristic indicates a mass of external PDF links generated for SEO purposes, pointing to a malicious distribution strategy. The embedded URLs are likely used to redirect users to further malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wca-stl.org/uploads/1/3/0/3/130323214/130323214.html#sql+server+query+pdf+free+download PDF link annotation
    • http://blakedroesch.com/uploads/1/3/0/7/130740232/3120036.pdfIn PDF document text
    • http://zeladvisorygroup.net/uploads/1/3/0/6/130640024/simepurilix_vamamow_jomuzajukubusi.pdfIn PDF document text
    • http://74-123-72-115.mgwnet.com/uploads/1/3/0/7/130775046/9901679.pdfIn PDF document text
    • http://mail2.maxims.sk/uploads/1/3/0/4/130489228/8823007.pdfIn PDF document text
    • http://kylinelsonteaching.com/uploads/1/3/0/5/130589444/3759726.pdfIn PDF document text
    • http://wedigllc.com/uploads/1/3/0/7/130739583/wurolugumi-jofogaworu-gepozipakegud.pdfIn PDF document text
    • http://garagedoorsuffolk.com/uploads/1/3/0/2/130291702/zaxenoz.pdfIn PDF document text
    • http://blazoncustoms.com/uploads/1/3/0/5/130588214/47058.pdfIn PDF document text
    • http://pccpnetwork.nhs.uk/uploads/1/3/0/5/130540186/edd2bbbdf.pdfIn PDF document text
    • http://www.cloutvibez.com/uploads/1/3/0/9/130969888/nibobokod.pdfIn PDF document text
    • http://loxelybeauty360.org/uploads/1/3/0/6/130604770/f9bbe6.pdfIn PDF document text
    • http://feministbookclub.org/uploads/1/3/0/5/130547969/6761172.pdfIn PDF document text
    • http://craxncrevices.com/uploads/1/3/0/3/130323485/dufozunusizifu_sololirun_ruxeriw.pdfIn PDF document text
    • http://mycyberphile.com/uploads/1/3/0/6/130604874/zomenokiw-mebeb-zesim.pdfIn PDF document text
    • http://mx.exponentialgoverning.com/uploads/1/3/0/5/130540420/rivod.pdfIn PDF document text
    • http://aprendizajeactivobrumiel.com/uploads/1/3/0/5/130540897/8171961.pdfIn PDF document text
    • http://totland-creative.com/uploads/1/3/0/4/130476276/ab000e.pdfIn PDF document text
    • http://www.st-john-baptist-church.com/uploads/1/3/0/7/130739020/wawazumojuvex.pdfIn PDF document text
    • http://thriftstorehemet.com/uploads/1/3/0/3/130323666/1748483.pdfIn PDF document text
    • http://birddelaney.com/uploads/1/3/0/3/130323407/016e71.pdfIn PDF document text
    • http://food.work/uploads/1/3/0/3/130313429/zujepomanewaxetaribe.pdfIn PDF document text
    • http://cafformation.org/uploads/1/3/0/8/130874409/8911951.pdfIn PDF document text
    • http://frenyella.com/uploads/1/3/0/3/130313741/zofovogu.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000776b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x776B 8660 bytes
SHA-256: c70eb1223405fb6fe25d521e95caf6934dd412dfcb0260106034a56f8bd8d4d9
font_01_sfnt_off00009886.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9886 1844 bytes
SHA-256: fafefca58569ab71c98438c913b939156ad2bf3ace198f4deac40d55ed74543d
font_02_sfnt_off0000a195.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA195 16164 bytes
SHA-256: bb7f3a77f7833b39fe6b0cf08265a5ad0460cb4bda91382e6c877c0db3ce514d

Open this report in the interactive analyzer, or submit your own file for analysis.