Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2a3fc39602b4910…

MALICIOUS

PDF

49.7 KB Created: 2020-03-23 11:49:37 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-04
MD5: 8d24fd02765c238008392c5a891be9cd SHA-1: 9e545a46b74474c17edef146a1eed8e1c13ccf17 SHA-256: d2a3fc39602b4910f8058fec05455d089e5e182a89ffd453bb9f4c4d46e6e74a
96 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

This PDF document exhibits characteristics of a link farm, embedding a large number of external URLs. The primary heuristic indicates a mass external PDF link farm, suggesting a tactic to manipulate search engine results or redirect users to potentially malicious content. While no scripts were extracted, the sheer volume of outbound links points towards a malicious intent, likely for SEO poisoning or traffic redirection. The document body contains garbled text and embedded URLs, further supporting this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ancestralbritain.com/uploads/1/3/0/7/130775455/130775455.html#%D0%B2%D0%BE%D0%B5%D0%BD%D0%BD%D0%B0%D1%8F+%D1%80%D0%B0%D0%B7%D0%B2%D0%B5%D0%B4%D0%BA%D0%B0+%D0%B7%D0%B0%D0%BF%D0%B0%D0%B4%D0%BD%D1%8B%D0%B9+%D1%84%D1%80%D0%BE%D0%BD%D1%82 PDF link annotation
    • http://commonwealth-designs.com/uploads/1/3/0/6/130604557/f67f9d.pdfIn PDF document text
    • http://foodeventsdenver.com/uploads/1/3/0/2/130289399/6441419.pdfIn PDF document text
    • http://www.ondemandcare.co.uk/uploads/1/3/0/5/130544295/3868431.pdfIn PDF document text
    • http://destinationweddingsbigisland.com/uploads/1/3/0/7/130775722/9a77d4326f.pdfIn PDF document text
    • http://cleanersrusllc.com/uploads/1/3/0/5/130541004/8e3e70eb.pdfIn PDF document text
    • http://mrsyatesclass.com/uploads/1/3/0/5/130589374/117466.pdfIn PDF document text
    • http://artisanofimagery.com/uploads/1/3/0/5/130539645/2867591.pdfIn PDF document text
    • http://suzannekompass.com/uploads/1/3/0/2/130272649/039679a.pdfIn PDF document text
    • http://kylomoon.com/uploads/1/3/0/6/130604042/dalojeguri.pdfIn PDF document text
    • http://independentdentalcenters.com/uploads/1/3/0/7/130739654/vavokebe_dijegu_dexagesosedeti_jejibobukames.pdfIn PDF document text
    • http://acutabove.us/uploads/1/3/0/5/130550817/9e7a65f388d58.pdfIn PDF document text
    • http://firsteditionconsulting.com/uploads/1/3/0/4/130488312/baxem-nufawilupejo-mewovafugodus-bagogomolasazit.pdfIn PDF document text
    • http://westtechmobile.ca/uploads/1/3/0/2/130291416/876883.pdfIn PDF document text
    • http://www.yourfrenchbulldoghomes.com/uploads/1/3/0/5/130551229/b7783.pdfIn PDF document text
    • http://abcvaletservices.com/uploads/1/3/0/8/130874424/fanexajetadoku.pdfIn PDF document text
    • http://sureitcan.com/uploads/1/3/0/7/130738903/7533133.pdfIn PDF document text
    • http://panicstudios.net/uploads/1/3/0/7/130775680/067f93d5a259.pdfIn PDF document text
    • http://nulled-shop.com/uploads/1/3/0/6/130622032/7447227.pdfIn PDF document text
    • http://pinestschool.com/uploads/1/3/0/2/130288552/paguzamavonuvuzivo.pdfIn PDF document text
    • http://sayerkh.com/uploads/1/3/0/6/130620767/rixemujibojifa.pdfIn PDF document text
    • http://gemmaderagon.net/uploads/1/3/0/2/130291489/e453b27.pdfIn PDF document text
    • http://gullakemichigan.com/uploads/1/3/0/5/130543600/kuxol_jezolufije.pdfIn PDF document text
    • http://www.hanshen.com.tw/uploads/1/3/0/7/130776647/fekamirepo_dapum.pdfIn PDF document text
    • http://ns1.gnghardware.com/uploads/1/3/0/5/130588956/83b8013548.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008c1e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8C1E 12660 bytes
SHA-256: 5525d224321dfd1b29ce00390eae48e1065496fe5437b6ff3e1477c65af6da6a

Open this report in the interactive analyzer, or submit your own file for analysis.