Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee9e2a03823efc9e…

MALICIOUS

PDF

51.1 KB Created: 2020-06-23 15:11:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 1f3e1f5fe19091c2105364e7bf8955bb SHA-1: 7eb376833ad75511395a734e6658204f067bbbfa SHA-256: ee9e2a03823efc9e04920b8df99a91de9e41297689cb4c18f007775a8a383b36
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files hosted on different domains. The ML classifier strongly indicated maliciousness. The embedded URLs are likely used to distribute further malicious content or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://timothyasmondyllc.com/uploads/1/3/1/6/131637034/131637034.html#waveguides+are+generally+made+of
    • http://webdisk.bowsforshow.com/uploads/1/3/0/7/130740462/1227364.pdf
    • http://ballparksports.net/uploads/1/3/0/8/130874424/4666547.pdf
    • http://ecfrancoisdesales.com/uploads/1/3/0/2/130289803/pasop_nefunuk_rubuposoxi_kimizelopiji.pdf
    • http://ccs-montebello.com/uploads/1/3/1/4/131455475/galupukilibi_belifigiwe_tesanosetakotat_povopofegata.pdf
    • http://kaufmanfinsvcs.com/uploads/1/3/0/3/130379844/dd010.pdf
    • http://hisaxfndn.org/uploads/1/3/0/6/130639131/a246e6a1056.pdf
    • http://m.midwivesadvantage.com/uploads/1/3/0/6/130620389/8631472.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000085d4.bin
bd8870f1e562b218d6e9ec5728e6de08a53853d573eb18e7f912797b44ac8459		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85D4 5204 bytes
font_01_sfnt_off00009777.bin
575170ee8bf596d8bf11779fad49ccf8612254c287f92e7acc89e118e78ee371		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9777 11796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.