Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb81b8e322705956…

MALICIOUS

PDF

47.9 KB Created: 2020-03-13 06:14:38 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6) First seen: 2020-09-24
MD5: 59ed771054d799650e7fa36f47d60395 SHA-1: 0733a5b7dd0302d706e242002a50be1e56294475 SHA-256: fb81b8e3227059565829436fb46ac343a46ee6e216c55bd17555b53c15f884cc
96 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to host malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates this behavior, with numerous links pointing to domains like whatscript.com and others. The document body contains a seemingly random string that includes one of the URLs, suggesting a potential lure or obfuscation tactic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://3dklx.bpmtc.com/uploads/1/3/0/6/130621337/130621337.html#hallelujah+shrek+leonard+cohen+mp3 PDF link annotation
    • http://whatscript.com/uploads/1/3/0/6/130621826/9848015.pdfIn PDF document text
    • http://mitchellgribbroek.com/uploads/1/3/0/8/130813732/6ae046c5d72e0.pdfIn PDF document text
    • http://paradiseuganda.net/uploads/1/3/0/7/130775796/vuzujogaluvekob.pdfIn PDF document text
    • http://keybiscaynetennislessons.com/uploads/1/3/0/6/130622101/nedebor_fukodadadupuk_juketatikig.pdfIn PDF document text
    • http://morgan.team/uploads/1/3/0/5/130589339/9876580c19.pdfIn PDF document text
    • http://dekrachtvanverbeelding.nl/uploads/1/3/0/8/130814479/satudapozeruju-mojodulano-lubukipidesu-wofufiw.pdfIn PDF document text
    • http://traditionalspirit.com/uploads/1/3/0/5/130590770/neposijetasif.pdfIn PDF document text
    • http://www.jeffevanstodd.com/uploads/1/3/0/3/130312913/narerijusowegidixamo.pdfIn PDF document text
    • http://barbertontreeservice.com/uploads/1/3/0/5/130588509/tenipisit.pdfIn PDF document text
    • http://theschizo.net/uploads/1/3/0/4/130476270/eed4b36.pdfIn PDF document text
    • http://webazoo.com/uploads/1/3/0/9/130969150/nufepopumi.pdfIn PDF document text
    • http://tigernitemail.com/uploads/1/3/0/7/130739780/e8747133c.pdfIn PDF document text
    • http://www.lowcountrycommunityservices.com/uploads/1/3/0/9/130968960/8835091.pdfIn PDF document text
    • http://nekimastrategy.net/uploads/1/3/0/7/130739945/bekupugene.pdfIn PDF document text
    • http://mx.foodcartfranchisingphilippines.com/uploads/1/3/0/3/130323894/7596707.pdfIn PDF document text
    • http://wakeforestfarmersmarket.com/uploads/1/3/0/5/130545932/4627171.pdfIn PDF document text
    • http://cardigancommuter.com/uploads/1/3/0/3/130379226/jupuxorolu_jixakawemoseje_lujopanegam.pdfIn PDF document text
    • http://mail.phimi.pt/uploads/1/3/0/6/130639489/4925071.pdfIn PDF document text
    • http://tkobg.com/uploads/1/3/0/5/130539090/lizikela_timon.pdfIn PDF document text
    • http://showupshutupandwrite.com/uploads/1/3/0/4/130436139/5b6d6744.pdfIn PDF document text
    • http://mx.renderdesigns.com/uploads/1/3/0/5/130538986/mibawozume.pdfIn PDF document text
    • http://kilkennyirishdance.com/uploads/1/3/0/4/130479123/cfd2fe67d8.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000898b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x898B 11064 bytes
SHA-256: 2988df39c5f6b20619333442de33f9af4f655d01f24d8a2f5217c1c6c71476bf

Open this report in the interactive analyzer, or submit your own file for analysis.