Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e8834db81d19a38…

MALICIOUS

PDF

45.5 KB Created: 2020-04-06 13:51:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6808c54162c6373c2714b2fdea4ce12f SHA-1: 6b81002254d8206f0e79c211216249ab29107b59 SHA-256: 1e8834db81d19a383d3a148d88c152d76b9e85d13c68bedef48fc7abfe609159
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to various domains, a technique often used for SEO manipulation or to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior. The document body, though heavily obfuscated, contains references to URLs that are also present in the extracted URL list. The primary intent appears to be driving traffic to a network of linked PDF files.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muddbunnies.club/uploads/1/3/0/5/130546392/130546392.html#tienda+rancho+las+luisas
    • http://hawthornedevelopments.com/uploads/1/3/0/5/130550938/21282f0.pdf
    • http://gifted-richmond.com/uploads/1/3/1/0/131070447/80b1c2c53c7.pdf
    • http://thatartshow.com/uploads/1/3/1/4/131438873/2556254.pdf
    • http://wheatonhills.com/uploads/1/3/0/7/130738847/d9413a8b.pdf
    • http://biblicalintensives.com/uploads/1/3/0/6/130604671/wibisoror.pdf
    • http://saasfeenest.com/uploads/1/3/0/8/130815437/9505280.pdf
    • http://eurasiainstitutes.org/uploads/1/3/0/5/130543685/fanobazizeb.pdf
    • http://mimillari.com/uploads/1/3/0/6/130621402/refagojozaxoxu_danisu.pdf
    • http://glossbossbyag.com/uploads/1/3/0/7/130775455/6534110.pdf
    • http://teenjobsny.com/uploads/1/3/1/4/131482832/zipagudote-fizilifulosene-nolaporojesevut-jibak.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007011.bin
389062dc7130c89267c6a1335bcbec3132a9dabad938f68ac6b3e2a6c3bfe363		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7011 10048 bytes
font_01_sfnt_off000093f9.bin
f9018317ee4914bc54654b970c74fd40edb9251344ba6f465890f14236d66110		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93F9 5928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.