Malicious PDF — malware analysis report

Static analysis result for SHA-256 de66761adf1dc94c…

MALICIOUS

PDF

39.6 KB Created: 2020-03-08 07:03:32 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 27c6b5b9a8b7539f7d03eaef240adb6a SHA-1: a9efdbdb98cf7e121e1313e823ad8d78e706b1cd SHA-256: de66761adf1dc94c90750ccf443fc2db8b2f40b6a9d757f622254dc86a5693f1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are hosted on domains that appear to be part of a link farm. The document body, though heavily obfuscated, contains references to 'spoken english for adults pdf' and numerous URLs, suggesting a lure to phishing or malware distribution sites. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sta-66-99-58-213.ladse.org/uploads/1/3/0/4/130476417/130476417.html#spoken+english+for+adults+pdf
    • http://107redirect.com/uploads/1/3/0/6/130621741/c3bd01a0467f6b.pdf
    • http://lakewayelmer.com/uploads/1/3/0/4/130476469/a941995cddb.pdf
    • http://4oh3.org/uploads/1/3/0/4/130494636/5303812.pdf
    • http://musicmegapack.com/uploads/1/3/0/6/130621217/zojasojevavaso-nejaje.pdf
    • http://mail.farmsteadproducts.com/uploads/1/3/0/5/130547515/973803.pdf
    • http://mvbabysitting.com/uploads/1/3/0/7/130739713/xasonik-notatar-mikoginelopozab.pdf
    • http://www.clearclutterfree.space/uploads/1/3/0/5/130589316/16be43.pdf
    • http://kalitedenetim.net/uploads/1/3/0/8/130814666/bixavadawu_dadinamodolukav_bonegaf.pdf
    • http://www.spgmaching.com/uploads/1/3/0/2/130288661/8d5a616.pdf
    • http://lucasgarron.net/uploads/1/3/0/5/130590738/risebobo.pdf
    • http://mta-sts.mx.wildlifewonders.org/uploads/1/3/0/2/130272580/jafimekiv_dakadejevi.pdf
    • http://timothyjohnsonltd.com/uploads/1/3/0/6/130604604/gerutepowok_pofojoteb_tiwivo.pdf
    • http://prettybakedqueens.com/uploads/1/3/0/6/130603793/gofixumipit.pdf
    • http://miriannysrivasfnpcmedicalaesthetics.com/uploads/1/3/0/7/130776737/86bd1.pdf
    • http://xactsound.com/uploads/1/3/0/6/130621715/24bed26.pdf
    • http://zealbyazlyn.com/uploads/1/3/0/4/130489143/pegasabudom.pdf
    • http://www.noisomheden.com/uploads/1/3/0/4/130435548/189c7081f4.pdf
    • http://securerelocationservice.com/uploads/1/3/0/3/130313585/3074265.pdf
    • http://prouni2022.com/uploads/1/3/0/6/130621626/d11de0a8fb42.pdf
    • http://dancetodaybiz.com/uploads/1/3/0/6/130605229/kofewemapiladu_novimividid_rimifawawuluvus.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000072aa.bin
ce07a373816254ee19cf613d789982e612423a5ff3a0666ae1cb3c1bf1dcaa7d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72AA 7844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.