Malicious PDF — malware analysis report

Static analysis result for SHA-256 1be4c49881957cbc…

MALICIOUS

PDF

44.1 KB Created: 2020-03-24 11:45:37 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 445e86084ec1e3793b3d3c00af3578a3 SHA-1: a018acaff748fe9594c8f3d7e807f74f45a9ea2c SHA-256: 1be4c49881957cbcff5c0694d153b5fe1232bf182ee1da630ae1841a3f0064ba
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains references to the URLs, suggesting a deliberate attempt to direct users to these external sites. The primary purpose appears to be SEO spam or a link farm, potentially leading to malicious content hosted on these numerous domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://grupoforrajeroxalos.net/uploads/1/3/1/0/131070190/131070190.html#comentario+b%C3%ADblico+hist%C3%B3rico+alfred+edersheim+pdf
    • http://sflavailabilities.com/uploads/1/3/0/3/130313091/7005591.pdf
    • http://www.dcciinspections.com/uploads/1/3/0/7/130775649/692918.pdf
    • http://makingmemoriesaca.com/uploads/1/3/0/6/130620789/0387e.pdf
    • http://dorewe.com/uploads/1/3/0/2/130289478/2276154.pdf
    • http://billyacopucci.com/uploads/1/3/0/3/130313237/dakubozigugufif.pdf
    • http://lilianching.com/uploads/1/3/0/8/130813846/4659424.pdf
    • http://enjoni-cafe.com/uploads/1/3/0/2/130289733/velasufakugem.pdf
    • http://multiples.media/uploads/1/3/0/6/130639545/2897583.pdf
    • http://pinkmarshmallowdesigns.net/uploads/1/3/0/6/130639516/xoseluguz.pdf
    • http://thesexcase.com/uploads/1/3/0/2/130288402/bb585e6.pdf
    • http://hentonhills.com/uploads/1/3/0/4/130483478/bufikuwojibe.pdf
    • http://www.mindbodypsychology.net/uploads/1/3/0/9/130969953/9398246.pdf
    • http://teckell.net/uploads/1/3/0/6/130605280/raxaxoketovo-girunul-saniwawik-jelusewexur.pdf
    • http://www.alicehudsonphoto.com/uploads/1/3/0/6/130604406/758333.pdf
    • http://riseuproadtrip.com/uploads/1/3/0/4/130488539/ganapuzeja.pdf
    • http://liverighthealthca.ca/uploads/1/3/0/5/130551072/5352807.pdf
    • http://mysospride.ca/uploads/1/3/0/7/130775936/lamavexexidatu_tamibago.pdf
    • http://abgbookkeeping.com/uploads/1/3/0/8/130873880/6ed600e.pdf
    • http://butterflykissescrafts.com/uploads/1/3/0/2/130287441/224bbd7ca7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007daa.bin
4cfa4f22bb9ad634c9f79e1698181fcda6c9199dde66a96b2038338d58b29762		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7DAA 9840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.