Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9ddb01b345f426e…

MALICIOUS

PDF

39.1 KB Created: 2020-06-23 19:04:27 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 18d4d0f15d3e1a5a8db14486d86cd766 SHA-1: 0a936e5d1f36aee92a37ea4a2d7cf2d86ca0af6e SHA-256: f9ddb01b345f426efde1405514e3059fd7a5909697ba82f5bfd9c92b415947e3
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document functions as a link farm, presenting a lure about roller derby skate wheels to disguise its true purpose. It contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, that redirect to other PDF files hosted on various domains. The ML classifier strongly indicated maliciousness, and the structure suggests a campaign to distribute further malicious content through a network of SEO-optimized links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://luhkreflo.com/uploads/1/3/0/6/130604215/130604215.html#roller+derby+skate+wheels+guide
    • http://mta-sts.mail.flavoredflowstudio.com/uploads/1/3/0/2/130292173/d0c9b7ae891.pdf
    • http://emilygriffithrfp.com/uploads/1/3/1/6/131607019/f9284a8fc39d.pdf
    • http://theloveofmeraki.com/uploads/1/3/1/4/131437924/f133c333090fea9.pdf
    • http://ournd.net/uploads/1/3/0/9/130969329/gilinesenofugu-delalat-laganaxos.pdf
    • http://solectwokamienica.pl/uploads/1/3/0/3/130379676/kunurur-vakaveg-vudinimesepa.pdf
    • http://mlhconsultancy.com/uploads/1/3/0/5/130542717/925879.pdf
    • http://thehealthymarketexpress.com/uploads/1/3/0/9/130968973/2396128.pdf
    • http://kenraye.net/uploads/1/3/0/5/130588468/serorax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c4a.bin
3bf4c73cdfc212f4328b41881624b18143aefb285d1dacd7834140b66ce3ddd9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C4A 5268 bytes
font_01_sfnt_off00006e61.bin
c70f737cfa19304301cf5e1dbeb4be0d760fc7b8cf8770ed91d8914bb39b7e6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E61 9844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.