Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ac3afd3e4341243…

MALICIOUS

PDF

35.8 KB Created: 2020-05-06 08:01:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6cbcfc77fdb9d5df8f57a2474b50620e SHA-1: 947990198c44ce077bad662ca9d831f6f9d2b6c0 SHA-256: 1ac3afd3e4341243daf87d5f44c0c6ade7f6bf16206562d26144dc2b64175ba9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, also contains URLs pointing to various PDF files. This suggests the primary function of this document is to act as a link farm, potentially for SEO manipulation or to redirect users to malicious content hosted on numerous domains. No scripts were extracted, limiting further analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://championspassingacademy.net/uploads/1/3/1/6/131606008/131606008.html#aceites+esenciales+pdf+unam
    • http://thecodefitness.org/uploads/1/3/0/7/130775683/916102.pdf
    • http://shift-it-transmissions.com/uploads/1/3/0/4/130477018/lofabejip-kavokidonizizev.pdf
    • http://emmausseries.org/uploads/1/3/0/7/130738680/2253352.pdf
    • http://marmeladapicks.com/uploads/1/3/1/4/131407445/xurar.pdf
    • http://allyouneedisgoodluck.com/uploads/1/3/0/7/130740513/3182114.pdf
    • http://sharigilbert.com/uploads/1/3/1/4/131454883/c6a1fbf269.pdf
    • http://windy-hill-village.org/uploads/1/3/0/5/130540280/a7d675f.pdf
    • http://rama-dasa.com/uploads/1/3/0/6/130639283/bawumeboviwavijulimi.pdf
    • http://newrulesamerica.org/uploads/1/3/1/3/131380183/mirelogafowuviron.pdf
    • http://tinakellyrn.com/uploads/1/3/0/3/130379231/ninovozozegeri.pdf
    • http://mysterytomb.com/uploads/1/3/0/2/130270832/dd367024cc1d.pdf
    • http://tawnshi.com/uploads/1/3/0/6/130604205/visedoxajir_jubudusunadad_majivilas_mebevupove.pdf
    • http://classicautomotives.com/uploads/1/3/0/6/130605164/9623185.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005f5c.bin
b40125a8897fbfaf79d7de21b0301c4f0c3ce7059084e9567fd8ac7fd98750f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F5C 11296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.