Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5ace7e9e1b29ee3…

MALICIOUS

PDF

65.3 KB Created: 2020-03-09 08:47:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: c53d8cc0400daf6e5e6e763beb316010 SHA-1: cf5c9db74a490ede2f08752f53288004e95cda65 SHA-256: d5ace7e9e1b29ee3a718f02a813de8e14f701edcb26525c098cfc1942952f672
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDFs hosted on various domains, indicating a link farm or redirection scheme. The ML classifier strongly flagged this PDF as malicious. The document body, though partially corrupted, contains references to the URLs, suggesting an attempt to direct users to these external resources. No scripts were extracted, and the primary malicious activity appears to be the distribution of links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://contact.rodhillportraits.com/uploads/1/3/0/3/130323392/130323392.html#what+does+laissez-faire+leadership+mean+in+sociology PDF link annotation
    • http://omnilider.org/uploads/1/3/0/5/130539928/kosotoderibe_vuxubakuti_panejotow_foxaxaposuf.pdfIn PDF document text
    • http://picacookie.com/uploads/1/3/0/4/130476242/817c2cbe46.pdfIn PDF document text
    • http://milfordmagic.com/uploads/1/3/0/2/130272233/2daa6dc2700e5.pdfIn PDF document text
    • http://www.rockylakecabins.ca/uploads/1/3/0/9/130969686/63e1cbb3fad08dc.pdfIn PDF document text
    • http://greaterpeoriaworks.com/uploads/1/3/0/3/130323268/pekaf.pdfIn PDF document text
    • http://reikijan.com/uploads/1/3/0/7/130775167/fisuwenedudani-karokafe-vezalemog-kujidodumos.pdfIn PDF document text
    • http://fior2019.com/uploads/1/3/0/7/130775032/9935561.pdfIn PDF document text
    • http://rockthedam.org/uploads/1/3/0/5/130547405/1835631.pdfIn PDF document text
    • http://cottageandcoastmarket.com/uploads/1/3/0/7/130739731/reratifo.pdfIn PDF document text
    • http://myxlplyx.com/uploads/1/3/0/6/130622093/41f8b85e984.pdfIn PDF document text
    • http://apexbasketballtraining.com/uploads/1/3/0/6/130639681/5974ff.pdfIn PDF document text
    • http://www.blendinghelp.com/uploads/1/3/0/5/130589184/3461873.pdfIn PDF document text
    • http://youarebow.com/uploads/1/3/0/4/130488483/6116262.pdfIn PDF document text
    • http://www.ohanamermaids.com/uploads/1/3/0/2/130288329/bedubunugojada.pdfIn PDF document text
    • http://sierrasun.ca/uploads/1/3/0/8/130815009/rezopagiwelepe.pdfIn PDF document text
    • http://www.davidlamondassociates.com/uploads/1/3/0/8/130814605/3a0fb890b16.pdfIn PDF document text
    • http://awanasanctuary.biz/uploads/1/3/0/8/130814020/xusevumadotav.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b2d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB2D9 9108 bytes
SHA-256: 17949531a12a86eb27cd6aa22e1a4fc21ae28b20db739f4dfdfd152a1ca1b3d9
font_01_sfnt_off0000d460.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD460 2768 bytes
SHA-256: 11eff0542ee112a7a4f3d5fa86892f13f7f7c80edb17354215cea33bb7714487
font_02_sfnt_off0000de2a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE2A 16800 bytes
SHA-256: 23961015d63b0dce392d6e33676fc5d90bc164fb9d34c99876a0e758364d7f1e

Open this report in the interactive analyzer, or submit your own file for analysis.