Malicious PDF — malware analysis report

Static analysis result for SHA-256 e055ac1cb8a2eee6…

MALICIOUS

PDF

40.6 KB Created: 2020-03-24 23:13:44 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1e41f049ceae776ceb5f94cc0872daf4 SHA-1: a70c528c7da938fb7d04c75cf0f1da17ae9c9933 SHA-256: e055ac1cb8a2eee6e4ce2177138a5a1c9ffa639f35a16e9100e89f62b83c8d9a
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that matches one of the extracted external links. This suggests the primary purpose is to redirect users to a network of linked PDF documents hosted on various domains, likely for SEO spam or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chrystalscreations.ca/uploads/1/3/0/5/130550948/130550948.html#formula+for+calculating+age+from+date+in+excel
    • http://jewelleryforgentlemen.com/uploads/1/3/0/5/130543740/jodiliditotakatariv.pdf
    • http://mx7.paterrealty.com/uploads/1/3/0/5/130588744/342051.pdf
    • http://www.beau-makeup.com/uploads/1/3/1/0/131070904/mifedi.pdf
    • http://www.televisetvnow.com/uploads/1/3/0/5/130543685/ziwimo_bozojogita.pdf
    • http://theowlpublishing.com/uploads/1/3/0/5/130551155/renagegalu.pdf
    • http://williambirtellrealestate.net/uploads/1/3/0/6/130620700/d43ec.pdf
    • http://fields-auto.com/uploads/1/3/0/6/130605080/buzegujujeziberikemo.pdf
    • http://reinventionqueen.com/uploads/1/3/0/4/130475936/6040837.pdf
    • http://optimumonsite.com/uploads/1/3/0/6/130640003/femez-bukiwuj-sapixezokaw-xosigixewi.pdf
    • http://home-cyber-protect.com/uploads/1/3/0/5/130551619/ca4b1d6c4e6.pdf
    • http://www.londonrural.com/uploads/1/3/0/4/130475925/803406a0c0c6a2.pdf
    • http://www.humandignitybook.com/uploads/1/3/0/7/130775589/pakexunasa.pdf
    • http://www.annkellettghostwriting.com/uploads/1/3/0/4/130488483/sexonomaxiwa-dopejubigopexos-bixifozogu-padotef.pdf
    • http://root8vegangf.com/uploads/1/3/0/9/130969021/2050189d.pdf
    • http://netwerkpijnrevalidatie.com/uploads/1/3/0/3/130324050/fagapalib.pdf
    • http://ohmyblingpaparazzijewelry.com/uploads/1/3/0/5/130546244/c786eb3b754.pdf
    • http://animalclinicofchardon.preview.pethealthnetworkpro.com/uploads/1/3/0/6/130621516/7156924.pdf
    • http://shiatsuthaiyogamassage.com/uploads/1/3/0/7/130739261/6790388.pdf
    • http://hayleysusanphotography.com/uploads/1/3/0/6/130621191/2733255.pdf
    • http://www.karibalexander.com/uploads/1/3/0/4/130476505/8599285.pdf
    • http://walkerrootsfoundation.org/uploads/1/3/1/0/131070096/6180294.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000074d0.bin
63d47de2fe82fa155a77a1254d23f1859a7ca25c06fff4861ed1bf9dfb09d923
pdf-font-stream PDF embedded font (sfnt) at offset 0x74D0 8172 bytes