Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4daac70db7211ac…

MALICIOUS

PDF

42.2 KB Created: 2020-04-15 07:54:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 21b9b6800ee52c2378cfa5208fc32cd9 SHA-1: 04e54669bad809ee4b127675ffbc24a5a3c90193 SHA-256: e4daac70db7211ac07a65682f4466dda0ea6437d874b322528437bc28f9e8a9c
136 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. The presence of a SE_LOLBIN_RUN_COMMAND heuristic indicates that the document contains instructions for executing Windows scripting tools. The document body itself is heavily obfuscated but contains URLs that are also listed in the heuristics, reinforcing the link farm hypothesis. The primary intent appears to be directing users to a network of websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://teleformav.org/uploads/1/3/1/3/131384298/131384298.html#bachianas+brasileiras+no+5+partitura+pdf PDF link annotation
    • http://mintconstruction.org/uploads/1/3/1/3/131398576/xekitojigedevit.pdfIn PDF document text
    • http://writeproject.org/uploads/1/3/1/4/131483465/jedovizugesejapuzab.pdfIn PDF document text
    • http://jennifersharpe.com/uploads/1/3/1/4/131437504/7087097.pdfIn PDF document text
    • http://avprestigio.com/uploads/1/3/0/5/130544090/mojekogazuwonu.pdfIn PDF document text
    • http://paris-lyon-japon.com/uploads/1/3/0/7/130739616/82e2177772.pdfIn PDF document text
    • http://grandsmarketinggroup.com/uploads/1/3/1/6/131606373/9184911.pdfIn PDF document text
    • http://karinamadrigal.com/uploads/1/3/0/5/130589267/5610229.pdfIn PDF document text
    • http://stewartcustomdesign.com/uploads/1/3/1/3/131378852/310f55795c.pdfIn PDF document text
    • http://babae.store/uploads/1/3/0/5/130551694/dakunexineno.pdfIn PDF document text
    • http://methodpotentialhmc.com/uploads/1/3/0/7/130775352/064426db5c60dd.pdfIn PDF document text
    • http://uritheintuitive.com/uploads/1/3/0/6/130603785/revozozejeme-jewujaboz.pdfIn PDF document text
    • http://saskiarooijakkers.com/uploads/1/3/0/7/130738562/tukitozo-katumuze-tozezurozu-xikopopalubu.pdfIn PDF document text
    • http://gupoficesa.com/uploads/1/3/1/1/131164248/jikifitavobebamuban.pdfIn PDF document text
    • http://iamoldhead.com/uploads/1/3/0/4/130478067/gawibup.pdfIn PDF document text
    • https://musescoreIn PDF document text
    • https://musescore.item-list:last-childIn PDF document text
    • https://musescore.netIn PDF document text
    • https://musescore.openx.1000000000000000055511151231257827021181583404541015625In PDF document text
    • https://musescore.jpg?cache=0In PDF document text
    • https://musescore.musescore.mid?revision=1510830444&no-cache=1586926487In PDF document text
    • https://musescore.com\rTheIn PDF document text
    • https://musescore.ultimate-In PDF document text
    • https://musescore.jsonpIn PDF document text
    • https://musescore.png?no-cache=1582804250In PDF document text
    • https://musescore.jpg@150x150?cache=1510830161In PDF document text
    • https://musescore.040000000000000000832667268468867405317723751068115234375In PDF document text
    • https://musescore.01000000000000000020816681711721685132943093776702880859375},{In PDF document text
    • https://musescore.com/static/musescore/scoredata/gen/4/1/3/4816314/7e4f4c8e016006cdd378c854a4d9f6582c9dd90b/space.mid?revision=1510830444In PDF document text
    • https://musescore.com/score/stats/delayed-view?score_id=4816314In PDF document text
    • https://musescore.com/user/26977499/scores/4816314/embedIn PDF document text
    • https://musescore.com/user/26977499/scores/4816314In PDF document text
    • https://musescore.com/user/21585386\rSupportIn PDF document text
    • https://www.com/score/stats/view?score_id=4816314In PDF document text
    • https://musescore.com/artist/villa_lobos_heitor-In PDF document text
    • https://musescore.com/ug/In PDF document text
    • https://musescore.comIn PDF document text
    • https://musescore.com/static/musescore/scoredata/gen/4/1/3/4816314/7e4f4c8e016006cdd378c854a4d9f6582c9dd90b/In PDF document text
    • https://musescore.com/static/musescore/scoredata/gen/4/1/3/4816314/7e4f4c8e016006cdd378c854a4d9f6582c9dd90b/score_0.com/user/26977499/scores/4816314In PDF document text
    • https://musescore.com/static/musescore/scoredata/gen/4/1/3/4816314/7e4f4c8e016006cdd378c854a4d9f6582c9dd90b/score_0.0In PDF document text
    • https://musescore.youtube.com/user/26977499In PDF document text
    • https://musescore.openx.com/user/26977499/scores/4816314In PDF document text
    • https://musescore.com/static/musescore/scoredata/gen/4/1/3/4816314/7e4f4c8e016006cdd378c854a4d9f6582c9dd90b/score.com/sheetmusic/artists/bachIn PDF document text
    • https://musescore.com/static/musescore/userdata/cover/7/1/2/26977499.05000000000000000277555756156289135105907917022705078125In PDF document text
    • https://musescore.musescore.com/user/21585386/scores/5634470/piano-tutorial?from=youtube_shareIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    +1 more URL(s)

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x79C6 9480 bytes
SHA-256: 2c030629dcd7f28682270b31d0a1a4ebc7295663b750a18a4c84ff1fd07c7a86

Open this report in the interactive analyzer, or submit your own file for analysis.