Malicious PDF — malware analysis report

Static analysis result for SHA-256 f04d58316ef86a93…

MALICIOUS

PDF

41.0 KB Created: 2020-03-20 13:51:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 5e6e3f8d4f4f8a4122f2845b35b95d88 SHA-1: 8ea20278cdef41ea44b5907ad8978926abcc7317 SHA-256: f04d58316ef86a93cfc8f0b923cbd5e403281b584aaa9329ac6d7f3a8705cb45
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF document contains a large number of embedded external links, a technique often used for SEO poisoning or to direct users to malicious websites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a potential phishing or malware distribution vector. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://issi.si/uploads/1/3/0/7/130775516/130775516.html#cuisinart+double+belgian+waffle+maker+%28model+waf-f20b%29 PDF link annotation
    • http://croftoncares.org/uploads/1/3/0/6/130620892/1531862.pdfIn PDF document text
    • http://hansenrealestategroup.com/uploads/1/3/0/8/130813055/fb9f9ae9.pdfIn PDF document text
    • http://www.hidden-gardens.com/uploads/1/3/0/6/130604429/nowin.pdfIn PDF document text
    • http://scwaterfrontworks.com/uploads/1/3/0/4/130488382/9494804.pdfIn PDF document text
    • http://marshmilitia.com/uploads/1/3/0/6/130639642/patasenororezoz.pdfIn PDF document text
    • http://builtonselfsuccess.net/uploads/1/3/0/7/130775758/5056604.pdfIn PDF document text
    • http://ptmusicacademy.com/uploads/1/3/0/2/130271219/6389496.pdfIn PDF document text
    • http://zuqiujiaolian.f18.ebkf.org/uploads/1/3/0/9/130969796/rakepivujimuvudef.pdfIn PDF document text
    • http://restaurierungsatelier-ernst.de/uploads/1/3/0/8/130813548/tosajarir_bajokuvam_fivimotu_wajubisuki.pdfIn PDF document text
    • http://chivoremerald.org/uploads/1/3/0/7/130776747/6052056.pdfIn PDF document text
    • http://signatureboutique.net/uploads/1/3/0/3/130323635/6546644.pdfIn PDF document text
    • http://jarredmatthes.org/uploads/1/3/0/3/130324063/90aa73144.pdfIn PDF document text
    • http://sharlamandere.com/uploads/1/3/0/7/130776420/44453e3d02c7b.pdfIn PDF document text
    • http://plane-workshops.com/uploads/1/3/0/7/130776578/9531987.pdfIn PDF document text
    • http://www.hairbyenessa.com/uploads/1/3/0/5/130539279/901d7c.pdfIn PDF document text
    • http://thehurtworld.com/uploads/1/3/0/6/130603803/dd05c7aa8.pdfIn PDF document text
    • http://www.empayar-jutawan.com/uploads/1/3/0/4/130489649/vukotuxaxo.pdfIn PDF document text
    • http://www.ellenrbnsn.com/uploads/1/3/0/3/130323632/5892411.pdfIn PDF document text
    • http://berkshireconstructiongroup.com/uploads/1/3/0/7/130775280/sajogifane.pdfIn PDF document text
    • http://theemberscovenant.com/uploads/1/3/0/6/130639452/fituwolagex.pdfIn PDF document text
    • http://www.carolgraham.net/uploads/1/3/0/5/130544652/xalebokipinawug.pdfIn PDF document text
    • http://pmpclones.com/uploads/1/3/0/7/130776801/bovokiwalivetu-wobefumonoxujax-xovanobi.pdfIn PDF document text
    • http://californiaspac.com/uploads/1/3/0/6/130621868/d5a08b40e68705.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007649.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7649 8144 bytes
SHA-256: 6f01d229042dc2c239857c87a564075df1a85f33e1572215eaf50315028bc6f4

Open this report in the interactive analyzer, or submit your own file for analysis.