Malicious PDF — malware analysis report

Static analysis result for SHA-256 f480368024a073ee…

MALICIOUS

PDF

53.1 KB Created: 2020-05-13 19:43:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 3fd4c0e446f7295ce83e2aa2475765e4 SHA-1: 9219920d11e7e93c02bfa68b8e08a5afd5147ded SHA-256: f480368024a073ee261b79e7c0f32847765c21c27866d5c157445bc6a2fc9aa8
136 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a large number of external links, indicating a link farm or SEO manipulation tactic. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests that the document may contain instructions for executing Windows scripting tools, potentially to download and execute further payloads. The primary intent appears to be directing users to a multitude of external sites, with the specific malicious action dependent on the content of those linked pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://spectrumherniaclinic.com/uploads/1/3/0/5/130540193/130540193.html#linear+sequences+worksheet+year+6 PDF link annotation
    • http://kkmediaagency.com/uploads/1/3/0/5/130539798/b24492.pdfIn PDF document text
    • http://rtatriaddevelopment.com/uploads/1/3/0/5/130541597/gonarafuga-juxazodoj.pdfIn PDF document text
    • http://fiestaharborcruisesinc.org/uploads/1/3/0/3/130324092/4819264.pdfIn PDF document text
    • http://montellossimplyhomemade.com/uploads/1/3/0/7/130738919/bazulukaje.pdfIn PDF document text
    • http://calvarybcsa.com/uploads/1/3/0/5/130590596/nanabete_sikafeviber_parogiwupetuvug.pdfIn PDF document text
    • http://nataliesoulardcalligraphy.com/uploads/1/3/0/6/130604758/993104.pdfIn PDF document text
    • http://blackovaldiesel.com/uploads/1/3/0/4/130476978/gopedul.pdfIn PDF document text
    • http://wildernesshomeinspection.com/uploads/1/3/0/4/130483385/sunir.pdfIn PDF document text
    • http://hvga.net/uploads/1/3/1/4/131437376/bezidojaj.pdfIn PDF document text
    • http://12741homanavenue.com/uploads/1/3/0/6/130621432/fiderikesuvesufojov.pdfIn PDF document text
    • http://tamoy87.com/uploads/1/3/0/2/130270897/8562260.pdfIn PDF document text
    • http://joyceandcraig.com/uploads/1/3/1/4/131406154/890339.pdfIn PDF document text
    • http://dtailspetboutiquespa.com/uploads/1/3/1/4/131408248/4881717.pdfIn PDF document text
    • http://mrobichaux.org/uploads/1/3/0/3/130313453/nizetomusije.pdfIn PDF document text
    • http://emilycurl.com/uploads/1/3/0/7/130775014/5e3b17932c48269.pdfIn PDF document text
    • http://priteashop.com/uploads/1/3/0/2/130274370/973dd7425cec.pdfIn PDF document text
    • http://culinarianconcierge.com/uploads/1/3/0/3/130313004/jikipe-wuzojawib-sataku.pdfIn macro / runtime command snippet
    • http://red-dot-prop.com/uploads/1/3/0/4/130476308/9738223.pdfIn PDF document text
    • http://northportleadership.com/uploads/1/3/0/5/130590142/9db5651ce6c.pdfIn PDF document text
    • http://yellowfoxprototyping.com/uploads/1/3/0/7/130739313/xumesub-renokoza.pdfIn PDF document text
    • http://9146718265315491.me/uploads/1/3/0/7/130775156/8735768.pdfIn PDF document text
    • http://danaselvis.com/uploads/1/3/0/2/130291623/6178c5ec90.pdfIn PDF document text
    • http://fullcircularity.com/uploads/1/3/0/4/130476786/dacb8.pdfIn PDF document text
    • http://hrmhack.org/uploads/1/3/1/4/131407110/tuduvapuga_xasuwaw_lojetopatunapi_wezuzevirele.pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text
    • http://scripts.sil.org/OFLIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a24e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA24E 11168 bytes
SHA-256: c37b1b57759c995bd01267833d184e22c5f1d21103db8b2ae65c67d77dbfc1d2

Open this report in the interactive analyzer, or submit your own file for analysis.