Malicious PDF — malware analysis report

Static analysis result for SHA-256 d723662ad489cc2c…

MALICIOUS

PDF

41.2 KB Created: 2020-03-14 04:42:48 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c7ca93c3b28c747c32a09b04a77f9afc SHA-1: 1add1128620f0e09da65224eefac50262c89d778 SHA-256: d723662ad489cc2c8dda605644468f6ac25f66f8eff02496a088f810f8a7880b
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to various domains, a technique often used for SEO poisoning or to distribute malicious payloads. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. The document body text, though partially corrupted, contains references to the URLs and appears to be generated content rather than user-facing text.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fitzgerald.rominastiebenphotography.com/uploads/1/3/0/8/130813869/130813869.html#acog+abnormal+uterine+bleeding+pdf
    • http://thenhdogcompany.com/uploads/1/3/0/8/130874201/1036604.pdf
    • http://naughtonsandblastinggalway.com/uploads/1/3/0/2/130271078/4435556.pdf
    • http://webmail.fillogreekbakeshop.com/uploads/1/3/0/4/130488265/puxebunubimipun.pdf
    • http://zollthai.com/uploads/1/3/0/5/130588377/7245051.pdf
    • http://aquariumsalesandservice.com/uploads/1/3/0/3/130379485/nenina.pdf
    • http://www.macombfsi.net/uploads/1/3/0/7/130775308/vofibumigolut.pdf
    • http://www.passionatetouchlala.com/uploads/1/3/0/4/130477026/1581138.pdf
    • http://www.hetaliadiscord.com/uploads/1/3/0/4/130488691/9571179.pdf
    • http://lighterofthemonth.com/uploads/1/3/0/5/130550805/zadomuvibataber-wevuka-dotilijetedev.pdf
    • http://westsidechapel.com/uploads/1/3/0/7/130775903/1e61d29d8ae.pdf
    • http://www.reoak.it/uploads/1/3/0/5/130544754/3134551.pdf
    • http://mygvhs.com/uploads/1/3/0/6/130639357/dokinalijafubem_falagetew_fokizujole_fozipoxiz.pdf
    • http://www.anamcara.co.nz/uploads/1/3/0/6/130604317/dewak_gimad_pizod_jafevaredix.pdf
    • http://kohai.moe/uploads/1/3/0/4/130478609/gosidoxugetuba-dijabekamimo-webozusoxarubo.pdf
    • http://allnurserd.com/uploads/1/3/0/5/130588982/404487.pdf
    • http://bigislandpartyrentals.com/uploads/1/3/0/7/130776177/jabiki_datogejojux_vumimuxab_mumumikuvo.pdf
    • http://mobadanceacademyus.com/uploads/1/3/0/6/130620228/2595385ed06e83.pdf
    • http://integratedconsultingsandeventsolutions.com/uploads/1/3/0/6/130621331/29f7e.pdf
    • http://sharkofficeservices.com/uploads/1/3/0/5/130539678/ribef_mugukop_tivuvalubil.pdf
    • http://darwinelitelandscaping.com/uploads/1/3/0/6/130639922/280cb5179d93c81.pdf
    • http://zenithenergy.com.au/uploads/1/3/0/4/130476317/201133.pdf
    • http://allerdad.com/uploads/1/3/0/5/130547215/0a84c2e4.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007828.bin
0adf25e128aa9cf4bb33254c75d845242de9b59246389d8146965164ab3bbeef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7828 7972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.