Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e9b0cbac612e25c…

MALICIOUS

PDF

40.0 KB Created: 2020-04-13 13:22:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5a57b15073e5c4cddd445c5115a936cc SHA-1: 53c2880bf56db2c67a3dca948ef6bebf34d4a248 SHA-256: 1e9b0cbac612e25cf2af40444a98f952879f7c0e74da9b8f7bc9c4e84333d314
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO poisoning or to direct users to malicious content. The document body, though partially corrupted, suggests a lure related to image file formats ('jpg o png'). No scripts were extracted, and the primary malicious activity appears to be the distribution of numerous links to potentially compromised or malicious websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://developmentalliance.org/uploads/1/3/0/4/130476069/130476069.html#que+es+formato+jpg+o+png
    • http://habetlercpa.ca/uploads/1/3/0/8/130814032/1406391.pdf
    • http://franzeloutfitting.com/uploads/1/3/1/3/131380083/7f0e7.pdf
    • http://nite-caps.com/uploads/1/3/0/6/130620789/tebule_puguguzomisa.pdf
    • http://theequeencollection.org/uploads/1/3/0/6/130605509/poratitejapitiwafo.pdf
    • http://clydeantronerpottery.com/uploads/1/3/1/3/131379228/defuduw_futifomozawi_lavuwosa_dasusida.pdf
    • http://theag3ncy.com/uploads/1/3/0/5/130541662/megovakavor_filakepovawok_buxidebigobalev_fazinuj.pdf
    • http://allaboutthemasses.com/uploads/1/3/0/7/130776328/genakapira-xusatuzuvesa.pdf
    • http://sicinkonline.com/uploads/1/3/0/6/130604305/soruwitog.pdf
    • http://opjunk.com/uploads/1/3/0/6/130639449/fowazu.pdf
    • http://gracemusicnyack.org/uploads/1/3/0/4/130488924/difosupukusatojevi.pdf
    • http://deltafirst.net/uploads/1/3/0/6/130621531/654f99fae6.pdf
    • http://nite-caps.com/uploads/1/3/0/6/130620789/t
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071f0.bin
542b5789b525e17e6b67804dd77eabc8d66b50272e7bbc6167e62f6160e49950		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71F0 9092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.