Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3640bd4f95eb2fb…

MALICIOUS

PDF

67.4 KB Created: 2020-03-10 02:11:00 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1f0c7c40db3eafc7daa47da5bfcc2358 SHA-1: d5ca791975ce04a953ba8735d57562e3233bbafc SHA-256: f3640bd4f95eb2fb7ae5dcc8e8cde1e4d38149619b99ae96efdfc2c6a8cf7ed1
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains numerous external links, a common tactic for SEO spam or phishing campaigns. The document body presents itself as a 'Free online reading comprehension assessment test', which is a lure to encourage users to click on the embedded links. The ML classifier strongly indicates maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a large number of external links, suggesting a link farm or redirection scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.garagedoorrepairhawaiiangardens-ca.com/uploads/1/3/0/5/130539125/130539125.html#free+online+reading+comprehension+assessment+test
    • http://babyak.net/uploads/1/3/0/8/130813497/deferumot.pdf
    • http://degreefinancialaid.com/uploads/1/3/0/8/130813694/tesatumikovaku.pdf
    • http://forestestates.org/uploads/1/3/0/5/130550681/bfecfb.pdf
    • http://dsy.allstars.org/uploads/1/3/0/6/130640104/5907444.pdf
    • http://www.naviencehairco.com/uploads/1/3/0/9/130969391/1338838.pdf
    • http://highlightshopping.com/uploads/1/3/0/8/130874339/jizawurizix.pdf
    • http://jymstringer.com/uploads/1/3/0/2/130274088/6255318.pdf
    • http://www.clearhomesolutions.org/uploads/1/3/0/8/130814448/saneweleri.pdf
    • http://trileafoutdoors.com/uploads/1/3/0/5/130539843/ledazebukekekifev.pdf
    • http://sharonmwilson.info/uploads/1/3/0/4/130483236/fuxozizezebirab-furiwuvuvu-dupanimezogaju-xenaxufo.pdf
    • http://nathallybastos.com/uploads/1/3/0/7/130739073/fd1fa08021880.pdf
    • http://tarajeandesigns.com/uploads/1/3/0/6/130622091/rapofivi.pdf
    • http://fractive.io/uploads/1/3/0/2/130287533/34b84abecf60f4.pdf
    • http://www.htownslams.com/uploads/1/3/0/5/130539325/af4452c7640834.pdf
    • http://bouncing4bullys.com/uploads/1/3/0/3/130313470/nogefidovu.pdf
    • http://gammaloudspeakers.com/uploads/1/3/0/5/130589085/5329165.pdf
    • http://www.wildewelpen.com/uploads/1/3/0/3/130313422/cb7b0d2.pdf
    • http://mail.tpsnz.co.nz/uploads/1/3/0/4/130488955/29eeab130b5401.pdf
    • http://futurematterssecondchance.com/uploads/1/3/0/4/130493816/konogarefitapud.pdf
    • http://honeycombgroomingllc.com/uploads/1/3/0/6/130639782/lodogo-legomes-fidugutibesiwu.pdf
    • http://myangelabartlett.com/uploads/1/3/0/6/130620561/bugepogopenaduv.pdf
    • http://littleels.com/uploads/1/3/0/5/130589338/8168203.pdf
    • http://de.janrosenow.com/uploads/1/3/0/4/130489627/jifivi_wonuzozovesamo_safen.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000df83.bin
83579adde39bb71817e4931ad800aab4cc4aff710fd1e83e33ec3c90828d7b1b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDF83 8236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.