Malicious PDF — malware analysis report

Static analysis result for SHA-256 e63758b898d53bbf…

MALICIOUS

PDF

38.9 KB Created: 2020-04-01 11:32:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 0f37c42aa6846656c386e6b976499056 SHA-1: 04899e091b9ecb118376048bf0fdd37c432d8d38 SHA-256: e63758b898d53bbf2c8343a9859e0b978f3243b675faed22de491aef2c0b103e
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on different domains. The document body text, though partially corrupted, includes a URL that is also present in the list of extracted URLs. This suggests the primary purpose of the PDF is to act as a link farm, potentially for SEO manipulation or to distribute further malicious content through the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rhiannongower.com/uploads/1/3/1/0/131069759/131069759.html#tuesdays+with+morrie+cast+of+characters
    • http://go15forum.com/uploads/1/3/1/3/131379326/bakozeziwat.pdf
    • http://astro-video.com/uploads/1/3/0/4/130483852/viwakezebi-vagaxerobusadel-nopavosidetaf.pdf
    • http://horsleyheightsestate.com/uploads/1/3/0/6/130604767/tifarinigutuvugu.pdf
    • http://racingtarget.net/uploads/1/3/1/1/131163955/7468782.pdf
    • http://dentalimplantsbeaverton.com/uploads/1/3/0/2/130272353/ea349e54.pdf
    • http://onthemovetherapy.com/uploads/1/3/0/2/130287894/78a33796.pdf
    • http://videoauditionpro.com/uploads/1/3/1/0/131070202/lufojaj_mitinoliso.pdf
    • http://mamarahimsalim.com/uploads/1/3/0/5/130588656/komipelu.pdf
    • http://17cornish.com/uploads/1/3/0/5/130543511/dunuxobozakez_relesorubi_nipesizenuzibi_gajitonu.pdf
    • http://epix.ie/uploads/1/3/0/4/130435694/fiwotetimejezes_rewuxirijozonug.pdf
    • http://voiceoverthesky.com/uploads/1/3/0/8/130814785/4c781dcd61e7.pdf
    • http://resortvacationsforless.com/uploads/1/3/1/0/131069987/degexuvex.pdf
    • http://thriveandnourish.com/uploads/1/3/0/3/130379341/0eefa.pdf
    • http://aprendizajeactivobrumiel.com/uploads/1/3/0/5/130539111/3068893.pdf
    • http://californiaspac.com/uploads/1/3/0/3/130379488/4b8ca3.pdf
    • http://cruzpromedia.com/uploads/1/3/0/8/130815097/5612094.pdf
    • http://indigoflowback.com/uploads/1/3/1/4/131413418/5100debd4.pdf
    • http://bodyethics.net/uploads/1/3/0/5/130551164/7a26873e108d6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000711c.bin
98715633fe8e214bd535692ce68eed93d662e4bcdc301ba7c263813cfa8feba1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x711C 7400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.