Malicious PDF — malware analysis report

Static analysis result for SHA-256 25aff38205c132bd…

MALICIOUS

PDF

33.1 KB Created: 2020-03-11 05:58:12 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5d038bbc70c258b0c366dfc54adea0d5 SHA-1: 68627bc2d2f7a95e52004cea89bc16bb730e5a1f SHA-256: 25aff38205c132bd1b82591595f7d47b1d4d6305436888919fa14e08126cd1cb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to similarly structured URLs on different domains. The document body text, though partially corrupted, includes a product name and the authoring application, suggesting a lure to disguise the malicious intent. The primary heuristic indicates a 'PDF SEO Link Farm', suggesting the document is designed to drive traffic to a network of linked pages, likely for phishing or malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-72-89.mgwnet.com/uploads/1/3/0/7/130738732/130738732.html#aleko+10+x+8+foot+retractable+patio+awning
    • http://shiva.americanhealthservices.org/uploads/1/3/0/3/130313082/wufalaloto.pdf
    • http://starsfinejewelryme.com/uploads/1/3/0/6/130605267/keboxifixowageruw.pdf
    • http://der-orchideengarten.com/uploads/1/3/0/5/130551898/07e4f321346.pdf
    • http://www.empireofthemoors.com/uploads/1/3/0/7/130775458/ead8ef5.pdf
    • http://leppitsch.link/uploads/1/3/0/5/130541131/2572975.pdf
    • http://electricalsource.org/uploads/1/3/0/4/130436166/pipodumixapekan.pdf
    • http://www.theemeraldadventures.com/uploads/1/3/0/5/130546971/85b6f17a7bfe0.pdf
    • http://davidsussmanlaw.com/uploads/1/3/0/9/130969990/09186.pdf
    • http://scofieldpleasantvalleydas.com/uploads/1/3/0/6/130604098/pimoxovujaravo.pdf
    • http://stbbqe.com/uploads/1/3/1/0/131070483/pusip_sosikokinuleb_worevawiruzoxer_xuredetola.pdf
    • http://unhiddenpilgrim.com/uploads/1/3/0/7/130775940/gidat.pdf
    • http://sinohandicraft.com/uploads/1/3/0/4/130478772/ronof_gedififiw.pdf
    • http://rem5vrlab.com/uploads/1/3/0/6/130604459/kejepu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005871.bin
52c546f9265d130a7bc9be8e2d29f3ad613e03df18e78421994f8537728389a1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5871 7840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.