Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f14004ca223594d…

MALICIOUS

PDF

54.3 KB Created: 2020-04-11 22:54:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 90592eaccff2fee0719de5cce32f86d4 SHA-1: 9ed7de30853fdda5581bb07754ceacdbe0cc3fcf SHA-256: 1f14004ca223594dd342220855c6ca3b25859441dc344c22d068d506730e9745
62 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information T1204 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named PDFs, suggesting a link farm or SEO spam tactic. The document body itself is heavily obfuscated but contains references to a 'Maytag neptune washer model mah5500bww manual', likely a lure to attract clicks. The primary heuristic indicates a mass external PDF link farm, with numerous URLs pointing to similarly structured paths on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://woodhilldoodlesandgoldens.com/uploads/1/3/0/5/130541803/130541803.html#maytag+neptune+washer+model+mah5500bww+manual
    • http://dublinbaseballgolf.com/uploads/1/3/0/4/130490053/2638265.pdf
    • http://danielrinaldi.com/uploads/1/3/0/7/130775309/3651600.pdf
    • http://thehumoflife.com/uploads/1/3/1/3/131379719/3065725.pdf
    • http://saatoperustus.fi/uploads/1/3/0/7/130775968/4051758.pdf
    • http://caliskanajans.com/uploads/1/3/0/2/130271072/7028004.pdf
    • http://sulasdominicanhairsalon.com/uploads/1/3/1/4/131406506/gudazerakip_bukipegoxete.pdf
    • http://easyvoxbox.net/uploads/1/3/0/8/130874300/7687734.pdf
    • http://mobilemaki.com/uploads/1/3/0/7/130776889/c328bd4c92016.pdf
    • http://duncangreenbank.org/uploads/1/3/0/9/130969963/1829552.pdf
    • http://bestshape.me/uploads/1/3/0/7/130739904/tuwafituzur_bupufipin_farubenil_kajapilaxomes.pdf
    • http://melissa-a-ortiz.com/uploads/1/3/0/9/130969976/3194888.pdf
    • http://walton200.com/uploads/1/3/0/5/130590111/laxusavorasuvavusa.pdf
    • http://salcocleaning.com/uploads/1/3/0/4/130492038/4790688.pdf
    • http://hopsandyeast.com/uploads/1/3/0/6/130621516/91c111.pdf
    • http://solutionsfocused.info/uploads/1/3/0/5/130539238/gokenenavanise-gazugabuzonelu-lajajosiluv-rufobezurazo.pdf
    • http://solutionsfocused.info/uploads/1/3/0/5/130539238/gokenenavanise-gazugabuzo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b5b1.bin
65372c2c4a43da243298f8212a3c5342a8ca9aaf3cfcb59e7562d97ed472fa0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB5B1 5644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.