Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce31646baef88f78…

MALICIOUS

PDF

38.8 KB Created: 2020-03-30 05:55:08 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e87c420192c5eeeab4d5229bb276d873 SHA-1: 31eadd5a266c2571b16de8e79d5ce1f13dfdfefe SHA-256: ce31646baef88f7830b8550a65d0178dadab883dfd769b1c102db6351e86a671
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, many of which point to neoaxethrowing.com and similar domains. The document body, though partially corrupted, contains a URL that appears to be a lure. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm designed to direct users to external content, likely malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-79-231.mgwnet.com/uploads/1/3/0/5/130589334/130589334.html#matthew+walker+why+we+sleep+ted+talk
    • http://neoaxethrowing.com/uploads/1/3/0/4/130476744/kimugekekegilop.pdf
    • http://atruelovestory.net/uploads/1/3/0/5/130547450/ximusi_pijulelibifo.pdf
    • http://ruleyourself.net/uploads/1/3/1/1/131163920/xugabunogoxop.pdf
    • http://okanp.org/uploads/1/3/0/7/130775690/3f2b956d5d8.pdf
    • http://ilmastointilaite.net/uploads/1/3/0/4/130436239/xazebo.pdf
    • http://2410323.xyz/uploads/1/3/0/7/130776276/024964f50c.pdf
    • http://westpotomacart.com/uploads/1/3/0/3/130379194/dawobokurazaw.pdf
    • http://tuckingmillapartments.com/uploads/1/3/1/3/131383917/rupimewugisuv-butafefaxar-biwikagidusagej-zalipeje.pdf
    • http://kdgag.com/uploads/1/3/0/8/130813765/7837536.pdf
    • http://wemisstheearth.org/uploads/1/3/0/6/130620407/losudunodig.pdf
    • http://jimhardina.com/uploads/1/3/0/9/130969887/ead3b9d0fce02c0.pdf
    • http://johnsoninteriors.shop/uploads/1/3/0/2/130271002/sovev_babowekon_pinaduru_rasazamitir.pdf
    • http://tdpropertyconcepts.com/uploads/1/3/0/9/130968961/demezexegejar_muxenubudu_bexafafirimaxe_tivupodunepeguw.pdf
    • http://gierkeconsultinginc.com/uploads/1/3/0/5/130589227/17139.pdf
    • http://gpdsolutions.net/uploads/1/3/0/7/130739446/furudonuxijadegafef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f3b.bin
efcde6d380444e20455ccaa47155f05f6b7ac6de3b20cf00a192bf07a0e4d7a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F3B 7828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.