Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd2ef6eeb58b6888…

MALICIOUS

PDF

119.0 KB Created: 2020-03-24 03:55:54 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: f53635303ec7d5f12c2ea23bf6c3b6d4 SHA-1: 3b42b75fe6289e33192811ef0210ae7f3eaf83c9 SHA-256: fd2ef6eeb58b6888f212c026c72187f44716404344fef52bc42e30f7668434d6
94 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDFs hosted on similar domains. This pattern is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ML classifier strongly supports the malicious nature of this document. No scripts were extracted, limiting the analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTAL
    The same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hepburnhideaway.com/uploads/1/3/0/5/130589161/130589161.html#programas+de+estudio+secundaria+mep
    • http://alustrielseportfolio.org/uploads/1/3/0/6/130604476/7ca47.pdf
    • http://webdisk.jenisonchoirs.org/uploads/1/3/0/5/130590622/3249897.pdf
    • http://echoforassembly.com/uploads/1/3/0/2/130270833/cddf64952b.pdf
    • http://rgbgrasstunes.com/uploads/1/3/0/2/130289813/mobat-fakidulu.pdf
    • http://design.providencerescuemission.org/uploads/1/3/0/4/130435583/7192068.pdf
    • http://swisscapillaire.com/uploads/1/3/0/7/130775400/6533001.pdf
    • http://simplyuniquesboutique.net/uploads/1/3/0/9/130969655/vibuve.pdf
    • http://ringerikskokken.no/uploads/1/3/0/7/130775137/nunanilezefu.pdf
    • http://jasonlim.biz/uploads/1/3/0/8/130813851/c7673425cc5a165.pdf
    • http://www.txinvite.com/uploads/1/3/0/5/130539843/ganumuzota.pdf
    • http://pnrsales.com/uploads/1/3/0/3/130379549/15106c9.pdf
    • http://perfectcandidates.com/uploads/1/3/0/5/130588475/dfce974e7fba7.pdf
    • http://www.claireseniorproject.com/uploads/1/3/0/7/130775951/nugizusifipo-ragug-romesofawixop-fujuzeva.pdf
    • http://mycpiggy.com/uploads/1/3/0/3/130313471/4802139.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001a2bf.bin
73147242ab1c64a1e0cffc5e6265b7d9fa9ef9c044d6e7d46f393dc10b12e0f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1A2BF 9576 bytes
font_01_sfnt_off0001c468.bin
bb66d78edca8aa75a8db461931e44ad6eab12e4cd439df836d92d13c6ef6c22d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1C468 2668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.