Malicious PDF — malware analysis report

Static analysis result for SHA-256 226436f9f553156e…

MALICIOUS

PDF

34.4 KB Created: 2020-03-20 12:19:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6bf086ec9e8988bd63597fa19021e8f0 SHA-1: 34638df458db52a57b2373194eff0d08dc013a8f SHA-256: 226436f9f553156ea5e03125329cf31c979a51999597c1b0fb9aa3e8e7caf9dc
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body, though partially corrupted, contains a URL that appears to be a lure for watching movies online. This suggests the PDF is designed as a link farm to redirect users to potentially malicious websites, possibly for phishing or malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://modernmarketco.com/uploads/1/3/0/9/130969445/130969445.html#twilight+new+moon+watch+online+free+with+subtitles
    • http://mindfulengagment.com/uploads/1/3/0/5/130538841/2543337.pdf
    • http://thecharmedfarmhouse.org/uploads/1/3/0/6/130621334/vamafugegon.pdf
    • http://www.investamericaeb5com.com/uploads/1/3/0/4/130483479/nepodokisixi-ponegol-fewelow-wonap.pdf
    • http://edubloom.org/uploads/1/3/0/5/130539074/882236.pdf
    • http://www.arth.services/uploads/1/3/0/7/130775475/nutirowizutelegolew.pdf
    • http://ryanhemerick2021.com/uploads/1/3/0/6/130604415/nezemeralejeno-mejufanemerapel.pdf
    • http://byalexandrialopez.com/uploads/1/3/0/7/130775346/jinegixokinupar-diwid.pdf
    • http://musebeatmedia.com/uploads/1/3/0/5/130540104/dcc29e6ac46b1.pdf
    • http://edgrowthgroup.net/uploads/1/3/0/4/130476632/fanadanosojerem-zimop.pdf
    • http://noticiasinternacionales.net/uploads/1/3/0/2/130291355/fb090b609.pdf
    • http://hostmaster.theglassgoddess.co.uk/uploads/1/3/0/6/130604109/damidolozomaw-mulun-jeveko.pdf
    • http://andychallmanmusiceducator.com/uploads/1/3/0/6/130639440/vokodawifizerenatiwu.pdf
    • http://refugeespeaker.org/uploads/1/3/0/5/130539311/zubibowox_rojita_luvunelodiku.pdf
    • http://www.5starembroidery.com/uploads/1/3/0/9/130969346/7c1e0.pdf
    • http://laurindajones.com/uploads/1/3/0/6/130604724/8902775.pdf
    • http://quinnowen.com/uploads/1/3/0/8/130813025/guxiraf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b76.bin
494e98792caa6c3422b607c65e575e8ba97f271bd91c89b6301972b4d97dd1d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B76 8516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.