Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a6351068450751e…

MALICIOUS

PDF

45.2 KB Created: 2020-03-15 08:09:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8bb9273a4da060259db469768f4dea53 SHA-1: 1465cedb32fd4eaaa5e4d18d76d3594070adede9 SHA-256: 2a6351068450751edfa024873a2137b166df0ca24f285be881986c0b936c716f
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for malicious content. The presence of a 'download button' lure further supports a malicious intent. No scripts were extracted, but the sheer volume of external links indicates a high likelihood of a phishing or malware distribution campaign.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thehandyhandyman.net/uploads/1/3/0/7/130775918/130775918.html#chooriyan+song++pagalworld
    • http://www.bluestockuk.com/uploads/1/3/0/8/130874371/nofofin_wavijipa_putuvewoxutis.pdf
    • http://replenishmysoul.com/uploads/1/3/0/6/130604522/janigixelanota.pdf
    • http://huangjiayulezhinan.br3h.com/uploads/1/3/0/7/130776415/824857.pdf
    • http://srilanka-explorer.net/uploads/1/3/0/6/130604907/jefokafewawu.pdf
    • http://bakedbounties.com/uploads/1/3/0/6/130639669/1213304.pdf
    • http://mta-sts.mail.billmohrart.com/uploads/1/3/0/2/130272415/maroxofizegitez.pdf
    • http://noestansolos.org/uploads/1/3/0/6/130622013/tanikiraxit.pdf
    • http://www.orkneydelidirect.com/uploads/1/3/1/0/131071262/0ee64de3a72b41a.pdf
    • http://bodywise.yoga/uploads/1/3/0/4/130492229/rolajif.pdf
    • http://susanrydberg.com/uploads/1/3/0/5/130550944/zafatolamedopigonudi.pdf
    • http://benkipiyako.org/uploads/1/3/0/7/130776022/xopozatow.pdf
    • http://www.earthrimtalks.com/uploads/1/3/0/7/130775731/a741934438.pdf
    • http://kaddllc.com/uploads/1/3/0/2/130272370/xonakikilo.pdf
    • http://rchildrenrfuture.com/uploads/1/3/0/4/130436196/460246.pdf
    • http://www.thefinestgourmetsalts.com/uploads/1/3/0/2/130287845/ruzedovowepemen-dapozavi-lozazesazudu-sakebegimurot.pdf
    • http://anchoredbydesign.net/uploads/1/3/0/6/130639412/0f3a6ebd5d.pdf
    • http://makrworld.com/uploads/1/3/0/7/130739326/5427828.pdf
    • http://langloisracinedancestudio.com/uploads/1/3/0/6/130621840/vukodobaroxifo.pdf
    • http://mycorporateteambuilding.com/uploads/1/3/0/7/130775306/demezos_surazisuxazivif_kakewuwum.pdf
    • http://pastmaster.org/uploads/1/3/0/8/130873872/zeduganavojiv.pdf
    • http://wamits.net/uploads/1/3/0/3/130379676/034100.pdf
    • http://www.jasonmetsamn.com/uploads/1/3/0/4/130490833/43a3e.pdf
    • http://adamrichardsteachingportfolio.com/uploads/1/3/0/5/130551132/ddcd23.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071b9.bin
c6bfdbe847b032ee141ab877e48d9ebe7c55ded9689165a606b1dae6cd5988ad		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71B9 8152 bytes
font_01_sfnt_off0000915e.bin
1cf5918eb87da496b8f919d30543eed1b73d5adf822c960429a9f2e5da86c3d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x915E 16188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.