Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a14b9e49fc51c0f…

MALICIOUS

PDF

45.6 KB Created: 2020-04-06 03:50:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4ca97eae02d42e555664ea73275cc70d SHA-1: 1e7b641fd4e234ec2756d21384432387f0f08ddf SHA-256: 1a14b9e49fc51c0f828d1ba036ab64f940b043882d296635e6156008e7fc50d0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a PDF link farm. The document body text is garbled, but the presence of multiple URLs suggests a lure to external content, potentially for SEO spam or to host further malicious payloads. No scripts were extracted, limiting the ability to determine specific malicious actions beyond link redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cutlovelee.com/uploads/1/3/0/5/130545742/130545742.html#tinta+para+pintar+cal%C3%A7ados
    • http://nccuallpass.org/uploads/1/3/0/6/130620435/bujujuzuvobetum_waxaloseras_nakokutoxikeb.pdf
    • http://offishalgear.com/uploads/1/3/0/7/130738755/getazuves-robirulapugise-zukidumimurulo-goviwag.pdf
    • http://dippedbytoria.com/uploads/1/3/0/7/130775259/2395812.pdf
    • http://thevillagetoyshare.com/uploads/1/3/1/3/131379940/4705525.pdf
    • http://luciddreamquest.com/uploads/1/3/0/5/130589032/9407036.pdf
    • http://gothic-flicks.com/uploads/1/3/0/2/130288551/b26cbf21f0b7ebe.pdf
    • http://materdeiirishfest.com/uploads/1/3/0/4/130435813/watiduwoj.pdf
    • http://autismparental.com/uploads/1/3/0/3/130313196/gupiluluw.pdf
    • http://livingthecreativelifestyle.com/uploads/1/3/1/3/131383619/3372629.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000676e.bin
9eec8aaa517084d02f952c2e9dae892b7fbe7bcb1e985db8664653b8c7f49f92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x676E 9944 bytes
font_01_sfnt_off000088a7.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88A7 2652 bytes
font_02_sfnt_off00009210.bin
a9a0cbdd47af2ea2cff5a4bf325ba0f4e4018825c54b81399ff3f9505b21a896		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9210 16088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.