Malicious PDF — malware analysis report

Static analysis result for SHA-256 fbcf0fc263f8a13c…

MALICIOUS

PDF

35.3 KB Created: 2020-04-04 16:09:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 352f6ed4bfd5e1ab24720e080a1660cf SHA-1: e8a0e82d55a3f29f51d088ae89db17cf01632b39 SHA-256: fbcf0fc263f8a13c6986eb50377bbdb0be5bd7a00fa60bb54d6e2291dacda1b4
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous embedded URLs pointing to external websites, a common technique for SEO link farms or phishing lures. The primary URL, http://holisticfreedom.shop/uploads/1/3/1/3/131381553/131381553.html#sistema+operativo+windows+7+precio, suggests a lure related to Windows 7 pricing. The ML classifier strongly flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://holisticfreedom.shop/uploads/1/3/1/3/131381553/131381553.html#sistema+operativo+windows+7+precio
    • http://irenekuiperphotography.com/uploads/1/3/0/2/130270987/muzubosixukodus_sorirubizitig_mofaniritenubiz.pdf
    • http://warrenstratton.com/uploads/1/3/0/2/130289765/koveto-lazisow-kifem.pdf
    • http://safecleanasc.com/uploads/1/3/0/5/130588337/jitumin.pdf
    • http://scprobatelitigation.com/uploads/1/3/0/8/130873893/b4ac0f5464d1e0e.pdf
    • http://appliedcleaningtechnologies.com/uploads/1/3/0/4/130436014/takimiw.pdf
    • http://tengoundolorfisicoenmicabeza.com/uploads/1/3/0/3/130379561/wajoneretewal-bunokozasaso-xogagapewobe.pdf
    • http://anthonyfleming.com/uploads/1/3/0/5/130538880/korojenas.pdf
    • http://iwasborntoshop.com/uploads/1/3/0/8/130874526/juvamavoro.pdf
    • http://vonshartzer.com/uploads/1/3/0/7/130775164/d5937e9d4.pdf
    • http://callamidwifesd.com/uploads/1/3/0/6/130639541/5e42f577051e.pdf
    • http://paul-mcallister.com/uploads/1/3/0/2/130287852/nogukamipo.pdf
    • http://regencyhotelhumbletx.com/uploads/1/3/0/3/130379193/2493182.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006085.bin
fa62f6e36347f22c2734da79d8563cbb05d19b7e1f6d3fb7bab87b61c2c91901		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6085 8608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.