Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4bba6bb8c19569b…

MALICIOUS

PDF

60.6 KB Created: 2020-03-22 07:57:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 0fd4291b8ccfbbc196efe844b9b3af9d SHA-1: b3ba8267900beff2d4d2f50eb807122bd488c68c SHA-256: d4bba6bb8c19569b3f353563114f3d31dfb9dddb53f8a70af1602610279b043d
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection strategy. The ML classifier strongly indicated maliciousness. The embedded document body text, though heavily obfuscated, contains a URL that aligns with the link farm findings. The primary intent appears to be directing users to external, potentially malicious, web content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fussbiskopf.net/uploads/1/3/0/2/130289045/130289045.html#serpentine+weapons+conan+exiles
    • http://robinstevensphotography.com/uploads/1/3/0/7/130739889/2789119.pdf
    • http://lindalanza.net/uploads/1/3/0/5/130588962/madixirotor.pdf
    • http://phoebehychan.net/uploads/1/3/0/5/130589049/1615954.pdf
    • http://burnsblufflodge.com/uploads/1/3/0/6/130620972/jubomemiwoxibejadup.pdf
    • http://ditasformayor.com/uploads/1/3/0/8/130874042/livebumepipaku-punuvur-zizukabewi-fosewip.pdf
    • http://chipperentertainment.com/uploads/1/3/0/7/130775750/15f9c46be36.pdf
    • http://myerstownboyscouts.com/uploads/1/3/0/7/130739401/rakelagosusaxuf_vudog_movunawibanibu.pdf
    • http://midiowaworkingdog.com/uploads/1/3/0/5/130590391/gekizekewesus.pdf
    • http://coltsound.com/uploads/1/3/0/6/130604549/xikaxonamele-xaragivopo-lusizibep.pdf
    • http://jfrancisblack.com/uploads/1/3/0/2/130271028/3672c0e.pdf
    • http://www.kforkaveh.no/uploads/1/3/0/2/130271212/bcba1ceb4.pdf
    • http://gearsgears.com/uploads/1/3/0/5/130541445/majugivodonamu_jomofojevusug.pdf
    • http://phoenixjourney.com/uploads/1/3/0/4/130488661/bedopavutovomed.pdf
    • http://trivwg.com/uploads/1/3/0/5/130588342/rugifezefedat.pdf
    • http://pocketlistingprescott.com/uploads/1/3/0/7/130776413/378da0eedf795d.pdf
    • http://hostmaster.aksjonforhaap.no/uploads/1/3/0/7/130775833/5684673.pdf
    • http://adriansbling.com/uploads/1/3/0/7/130739210/pigur-makatixado-texawevazonas-lokodibu.pdf
    • http://pepay.host/uploads/1/3/0/6/130605146/7156538.pdf
    • http://legendarypearls.org/uploads/1/3/0/6/130639531/a2446be.pdf
    • http://officialgh.com/uploads/1/3/0/8/130873795/melimawaraxuj-pomaliwaka.pdf
    • http://carllarosa.com/uploads/1/3/0/2/130289478/4817520.pdf
    • http://www.kidsclubasia.com/uploads/1/3/0/5/130588559/1256862.pdf
    • http://thepropertyamazon.com/uploads/1/3/0/2/130287246/sukidop.pdf
    • http://www.golfconnectsne.com/uploads/1/3/0/7/130775172/6d3313e55b.pdf
    • http://www.amikesecurity.palmer-asia.com/uploads/1/3/0/3/130323174/rafixuga.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c3ad.bin
ed6d064328282f82920868566029c6710a79c409334c00d7d8cd26a83dbac2cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC3AD 8456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.