Malicious PDF — malware analysis report

Static analysis result for SHA-256 22dbbc8ea905e42d…

MALICIOUS

PDF

49.4 KB Created: 2020-03-20 03:09:40 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 40befc02c3b38716a2f98c58b6fd69a6 SHA-1: 3602a801d57cb1a1182c39250a15a90e31467cf4 SHA-256: 22dbbc8ea905e42d4b19d62e2ffc71c8f3319771133bccc031faec866d9d0b10
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text mentions 'Elaboracion de objetivos smart', which appears to be a lure. The primary IOC is the first external URI, http://whyagileteamsfail.com/uploads/1/3/0/5/130539016/130539016.html#elaboracion+de+objetivos+smart, which leads to a collection of other PDF files hosted on various domains. This suggests a link farm or redirection scheme designed to drive traffic or host further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whyagileteamsfail.com/uploads/1/3/0/5/130539016/130539016.html#elaboracion+de+objetivos+smart
    • http://carolinetaylor.com.au/uploads/1/3/0/3/130313247/ef01b70da76bb.pdf
    • http://productiveproductcreation.com/uploads/1/3/0/6/130639762/1078455.pdf
    • http://www.mirikatzman.com/uploads/1/3/0/5/130589159/6731217.pdf
    • http://stonemountaincoop.com/uploads/1/3/0/5/130551661/4093239.pdf
    • http://nataliekasdan.com/uploads/1/3/0/3/130379172/1486622.pdf
    • http://portsidecommunityartsfest.org/uploads/1/3/0/5/130588295/riwoj-kapemejexipujo-dumujefagufinem-soxepa.pdf
    • http://sekolahberpikirindonesia.com/uploads/1/3/0/6/130620194/xolidulewolozub_wewakejabonisi_lolimiv.pdf
    • http://track-tech.net/uploads/1/3/0/8/130813732/b3e4e0f2d0a63.pdf
    • http://roundupgiving.org/uploads/1/3/0/4/130488584/6202493.pdf
    • http://highclassgoods.shop/uploads/1/3/0/5/130539247/barerilam-sofizitow-fajinovo.pdf
    • http://ifyousuffer.com/uploads/1/3/0/6/130604626/27a41a1363.pdf
    • http://travelandtrendswithz.com/uploads/1/3/0/5/130550948/b254b7fb.pdf
    • http://siesbajio.com/uploads/1/3/0/3/130323633/xudurigis.pdf
    • http://www.streetacademics.com/uploads/1/3/0/2/130289542/tixufalazijanat-numujibijutow.pdf
    • http://portraitprecision.com/uploads/1/3/0/7/130739462/jokudor-loxufifuwekin-nusadewixukoz.pdf
    • http://quality1staluminum.com/uploads/1/3/0/6/130639030/49dfb178b499d.pdf
    • http://bnnlegal.com/uploads/1/3/1/0/131071111/c70425321.pdf
    • http://hostmaster.georesource.co.uk/uploads/1/3/1/0/131070590/putubite.pdf
    • http://available38.unix1.com/uploads/1/3/0/7/130740537/3695615.pdf
    • http://carolinedivine.com/uploads/1/3/0/8/130814909/8724238.pdf
    • http://tieskeshop.club/uploads/1/3/0/5/130588656/57f4074ed48b1a6.pdf
    • http://arpageddon.com/uploads/1/3/0/6/130639244/rabolewemiteke-gewizurugosex-kiruxilurarogo-bisekibuwibo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009418.bin
4c38a8c5fd7553918199c71dd297a4e7656875ccc7e5e89263a12db1e29e9a92		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9418 9580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.