Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9d5eaf93534f123…

MALICIOUS

PDF

116.1 KB Created: 2020-06-12 13:18:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7) First seen: 2020-09-24
MD5: a2d7d670eac9040b0e753291d780866d SHA-1: a598d1fc2811d4157683c5a4c1495a90852d590f SHA-256: e9d5eaf93534f123914de83648ac9e02f760e720d9fa3f3c01d7ae0aaacd7a08
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a phishing campaign. The ML_NYX_PDF_MALICIOUS heuristic also strongly indicates malicious intent. No scripts were extracted from this sample, and the document body was not sufficiently readable to determine a specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://suntidetravels.xsideas.com/uploads/1/3/0/6/130620436/130620436.html#%25D8%25A5%25D8%25B9%25D8%25A7%25D8%25AF%25D8%25A9+%25D8%25AD%25D8%25B3%25D8%25A7%25D8%25A8+%25D8%25AA%25D9%2583%25D9%2584%25D9%2581%25D8%25A9+%25D8%25B7%25D8%25A7%25D9%2588%25D9%2584%25D8%25A9+%25D8%25A7%25D9%2584%25D8%25A8%25D9%2584%25D9%258A%25D8%25A7%25D8%25B1%25D8%25AF%25D9%2588 PDF link annotation
    • http://velvetbuddhaarts.com/uploads/1/3/0/6/130639528/xoxuxavulepoxa.pdfIn PDF document text
    • http://merrikfish.com/uploads/1/3/0/7/130738975/f6047824c315d4.pdfIn PDF document text
    • http://arpsecure.com/uploads/1/3/0/6/130604952/4032af98a165a8.pdfIn PDF document text
    • http://74-123-73-221.mgwnet.com/uploads/1/3/1/6/131636833/vuromifob_nigajomoxune_gifubasufu_xuwenufulorekil.pdfIn PDF document text
    • http://tflowmusicgroup.com/uploads/1/3/0/2/130287426/83652b01ec2dd7a.pdfIn PDF document text
    • http://2u.undesirable.us/uploads/1/3/1/4/131438432/5616b0f0.pdfIn PDF document text
    • http://marthamckaydesign.com/uploads/1/3/0/9/130969623/jakesusofutole.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://kidubivo.files.wordpress.com/2020/06/joxafazidox.pdfIn PDF document text
    • https://nitodixusaki813822408.files.wordpress.com/2020/06/69699004089.pdfIn PDF document text
    • https://ruxejetufe.files.wordpress.com/2020/06/93207694891.pdfIn PDF document text
    • https://lotodirod.files.wordpress.com/2020/06/9328407337.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_005_off00016006.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x16006 36172 bytes
SHA-256: e1eafc0df3aad042b8121c4590023946804eedfd49ab7530a9421696501b9e14
font_00_sfnt_off00013352.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13352 6588 bytes
SHA-256: fa72874b8c381873b432d3b5cea9ecddba20f04e8e1c9face7d560df1136061a
font_01_sfnt_off000143c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x143C0 8444 bytes
SHA-256: 73adb1761e0dfc70226edd9bb5741de62e12b971cc34a7bc937f241c2a501a95
font_03_sfnt_off0001a03d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A03D 9516 bytes
SHA-256: e8edb02a3a8445e77fdd9c8fecee1ef2e31ac8e3d8b567927c3b79e91a5f98f6

Open this report in the interactive analyzer, or submit your own file for analysis.