Malicious PDF — malware analysis report

Static analysis result for SHA-256 d4d79fa20fdb464a…

MALICIOUS

PDF

49.5 KB Created: 2020-03-20 06:21:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-07
MD5: c31af9973a46836e622d7a608c884d8a SHA-1: 41f5f9343da87d64dc340e8a84faf5131a3f7ca2 SHA-256: d4d79fa20fdb464a18fe89cd0c2e363060b76d17d8611a4932e5b0bec6fd2356
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are numerically or generically named, suggesting a link farm designed to host malicious content or redirect users. The document body, though partially corrupted, contains text related to architectural design analysis, which is likely a lure to encourage clicks on the embedded URLs. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious linking behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://updamyacess.com/uploads/1/3/0/5/130546000/130546000.html#analisis+de+dise%C3%B1o+arquitectonico PDF link annotation
    • http://postfineartstudio.com/uploads/1/3/0/6/130620474/pamunep_xatoxoz_memek.pdfIn PDF document text
    • http://www.nocompromisecustoms.com/uploads/1/3/0/2/130289431/waseveta-folivikoja-karojalagefur-figexukexogaw.pdfIn PDF document text
    • http://mail.edgelandscapeandmaintenance.com/uploads/1/3/0/6/130640071/6538630.pdfIn PDF document text
    • http://webeginwithin.com/uploads/1/3/0/7/130740008/2116188.pdfIn PDF document text
    • http://mta-sts.mail.cape912.com/uploads/1/3/0/5/130545957/vazinanovuruxax-fugexawomo-vikefewobekeg.pdfIn PDF document text
    • http://www.artfulcoaching.org/uploads/1/3/0/5/130550938/gobamas-zubeguza.pdfIn PDF document text
    • http://madelinecsmith.com/uploads/1/3/0/4/130476887/5278952.pdfIn PDF document text
    • http://atypikalstyles.com/uploads/1/3/0/7/130776169/acc21de4d0fc89b.pdfIn PDF document text
    • http://tickled-ink.co.uk/uploads/1/3/0/3/130324451/c5f4a8569b3.pdfIn PDF document text
    • http://bobyodice.com/uploads/1/3/0/4/130483474/kusijugogagobakorasu.pdfIn PDF document text
    • http://vaperightnow.co.uk/uploads/1/3/0/7/130739309/d53235f828be0e.pdfIn PDF document text
    • http://dirtysoles305.com/uploads/1/3/0/6/130620892/zipevajujakiv.pdfIn PDF document text
    • http://haydenshaven.net/uploads/1/3/0/5/130540197/vanirevimilog.pdfIn PDF document text
    • http://musicmegapack.com/uploads/1/3/0/6/130621217/zojasojevavaso-nejaje.pdfIn PDF document text
    • http://deltachipurdue.com/uploads/1/3/0/6/130605143/kakezikufot_rasimipiviriz_kukofagosimaf.pdfIn PDF document text
    • http://www.expatwall.com/uploads/1/3/0/5/130588434/919b2fd73.pdfIn PDF document text
    • http://webmail.thebellevie.com/uploads/1/3/0/2/130272928/6829085.pdfIn PDF document text
    • http://peggyleavitt.com/uploads/1/3/0/7/130776126/gabozixa_badem_fenibixifebo_wowadesamumew.pdfIn PDF document text
    • http://viceroyautotrans.com/uploads/1/3/0/2/130271015/1528866.pdfIn PDF document text
    • http://www.archerautomotiveandtire.com/uploads/1/3/0/4/130478004/bedit.pdfIn PDF document text
    • http://condosurbains.ca/uploads/1/3/0/4/130488416/ladipegi.pdfIn PDF document text
    • http://mokka.app/uploads/1/3/0/6/130640006/wirekezavadako_xatudepotawuku_buzorawuvodare_xudopimekaxine.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000974b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x974B 8520 bytes
SHA-256: f1164fcf8b7238210c581c747b8cb5d13fad98ba5daeedba19a210c7f17e88dd

Open this report in the interactive analyzer, or submit your own file for analysis.