Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9c003a7cde43b3f…

MALICIOUS

PDF

121.8 KB Created: 2020-03-28 11:39:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1b0adc251be83443121dd970765e08d2 SHA-1: a3c350637ef569f8151644afa3ea78d4d9771b29 SHA-256: c9c003a7cde43b3fe6da208634b9db2eaa3ce20c379d7a3fb31649c05d58da89
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged as malicious by an ML classifier. It contains a large number of external links, many of which point to other PDFs, suggesting a link farm or SEO abuse tactic. The document body contains metadata and a URL that further supports this observation. The primary attack pattern involves directing users to a network of potentially malicious or spam-related websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://witherlysgreenhouse.com/uploads/1/3/0/6/130621481/130621481.html#1+litre+of+tears+diary+pdf
    • http://kirkparrish.com/uploads/1/3/0/6/130620801/ca46c5db66.pdf
    • http://carolinedecima.com/uploads/1/3/0/7/130776106/1254393.pdf
    • http://hawaiiluxurygroup.com/uploads/1/3/0/2/130289682/vudoxezuwuxi_zobonusogis_zadikovesomojup.pdf
    • http://sangnosis.org/uploads/1/3/0/4/130477074/0ee100c442ee.pdf
    • http://mx.talbotspecialriders.com/uploads/1/3/0/2/130273581/4629427.pdf
    • http://scarletcarnival.com/uploads/1/3/0/7/130738512/2924957.pdf
    • http://clintonsears.com/uploads/1/3/0/5/130539871/joferirivofu.pdf
    • http://tourslatam.com/uploads/1/3/0/4/130477755/goxepanudewawa.pdf
    • http://www.gamblinggods.com.au/uploads/1/3/0/2/130270893/daragowun.pdf
    • http://thecreativehealingstudio.com/uploads/1/3/0/5/130551222/wejogelorizavud_dafefovajejirab_zuzosukojonubut.pdf
    • http://www.dancingforjoybook.com/uploads/1/3/0/6/130639442/733766.pdf
    • http://frbasketball.org/uploads/1/3/0/5/130551477/bowutupuv_muvaguluwatibi.pdf
    • http://tuxebase.com/uploads/1/3/0/6/130620343/jenanajunud.pdf
    • http://albaraxface6.com/uploads/1/3/0/5/130588201/bf74a2b983caa5.pdf
    • http://carlosguzmanphoto.com/uploads/1/3/0/6/130622038/2683830.pdf
    • http://apeculiarthud.com/uploads/1/3/0/6/130605291/jodejakunuloge_waduzamodirugi_xovila.pdf
    • http://masterkidscyprus.com/uploads/1/3/0/5/130588614/ab123f03e.pdf
    • http://www.roofingcalgary.org/uploads/1/3/0/4/130483739/ketubozosug.pdf
    • http://shrinesearch.com/uploads/1/3/0/3/130313192/b9a17b075ab7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_010_off0001b582.bin
69e5ad9562563048881e9bde18489530c1c91108a523b49f8de11ef781e23518		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x1B582 19668 bytes
font_00_sfnt_off00015990.bin
4574a39dc191c24cdcac9949ced87fae04810477c7da7d15a9c289ec01553802		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15990 9420 bytes
font_01_sfnt_off00017ca2.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17CA2 2596 bytes
font_02_sfnt_off00018597.bin
8023e1ea3f034af0edd6d51f4425acaa10bc4a94386563e830074be2994ec4e6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18597 15140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.