Malicious PDF — malware analysis report

Static analysis result for SHA-256 20949c55e38705cf…

MALICIOUS

PDF

40.5 KB Created: 2020-04-01 17:50:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7d0fcff6cfec5b2082ea29543538cfa1 SHA-1: 2140dca1a7f9165470060c87ebe46e69eaaac763 SHA-256: 20949c55e38705cf14bebfdff8bf2071595bfcd709902633a788952cca5f7f61
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique often used for SEO spam or to redirect users to malicious sites. The PDF_SEO_LINK_FARM heuristic specifically flags this behavior. No scripts were extracted, and the document body is heavily obfuscated, making it difficult to determine a more specific attack pattern beyond link farming.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fall4westover.com/uploads/1/3/1/4/131437605/131437605.html#convert+text+file+into+csv+online
    • http://nightmaremuscle.shop/uploads/1/3/0/5/130540493/2ff223967.pdf
    • http://summersapp.com/uploads/1/3/1/3/131383592/larof_nipexosuvowipim_punukenopoz.pdf
    • http://sweetlifepilates.com/uploads/1/3/0/8/130814208/fa54ae.pdf
    • http://wdfoto.com/uploads/1/3/0/4/130476068/b597d7a0767a77c.pdf
    • http://qualityoflifeplanmanagement.com/uploads/1/3/0/4/130435959/5fbb472d2eaf02e.pdf
    • http://dollrdollr.com/uploads/1/3/0/4/130436122/wopuposi-lukeli.pdf
    • http://www.tewkesburycookshop.co.uk/uploads/1/3/0/7/130775560/pajixu_duluge_bazes.pdf
    • http://cbd-bae.com/uploads/1/3/0/4/130483872/legugifo.pdf
    • http://theforceoftruthministries.com/uploads/1/3/0/2/130274028/todajovij_didudokilot_vuzapegowokelor_ruxevuvux.pdf
    • http://english-cocker-spaniels.com/uploads/1/3/0/5/130545643/tifajizuvivoxivegari.pdf
    • http://andatrades.com/uploads/1/3/1/3/131383424/9799198.pdf
    • http://mohawk.chambernation.com/uploads/1/3/1/4/131405934/7495b45810b6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007535.bin
ed5c6af6ee1e907cf56799a04f7b2ee161ff12e0e3227a4a492811dd35087608		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7535 8324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.