Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a967a2b735b9333…

MALICIOUS

PDF

45.7 KB Created: 2020-03-08 13:04:20 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5cf06d80bbef216219ce7f0a4601e867 SHA-1: 726f42494ecc9f8d750389bb366f4c1443898719 SHA-256: 2a967a2b735b9333aba520fc46a51788ef85d79f8266220e984364c6c2f44631
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The document body, though partially obfuscated, contains a title related to '3ds max' and a URL that appears to be part of this link farm. The heuristic 'PDF_SEO_LINK_FARM' specifically flags the presence of numerous external PDF links, indicating a likely attempt to distribute or host malicious content across multiple domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://qcukm.bpmtc.com/uploads/1/3/0/4/130435679/130435679.html#how+to+hide+vray+light+in+3ds+max
    • http://carpenters605.org/uploads/1/3/0/7/130740151/4042241.pdf
    • http://workingdeadfilm.com/uploads/1/3/0/6/130605299/8218162.pdf
    • http://floatyourmat.com/uploads/1/3/0/7/130776008/kavuraxezusa.pdf
    • http://springcreekranchclublambs.com/uploads/1/3/0/7/130738903/mirizuwugiba.pdf
    • http://webmail.marksoutdoors.com/uploads/1/3/0/4/130476594/a12ca7b0.pdf
    • http://gigivangos.com/uploads/1/3/0/5/130588424/tokaj.pdf
    • http://vt0.net/uploads/1/3/0/6/130639406/8624304.pdf
    • http://drillpeak.com/uploads/1/3/0/6/130621582/9495665.pdf
    • http://bwstook.com/uploads/1/3/0/2/130289523/2334306.pdf
    • http://www.greenteahawaiiinfo.net/uploads/1/3/0/7/130740050/dibupadaweveli.pdf
    • http://shepherdslair.com/uploads/1/3/0/6/130621223/afaa37e17851f.pdf
    • http://aeon-labs.org/uploads/1/3/0/6/130604886/31302287fcd7.pdf
    • http://cherylmusgrave.com/uploads/1/3/0/9/130969904/7638259.pdf
    • http://onlygodcanjudgeus.com/uploads/1/3/0/5/130539370/balutag-pujotevol-xidugu.pdf
    • http://paydaylendinginvestigation.com/uploads/1/3/0/7/130775531/fapenejepovekitotud.pdf
    • http://www.aliciadaman.com/uploads/1/3/0/7/130739267/3080547.pdf
    • http://addictiontraumacounselling.ca/uploads/1/3/0/8/130873802/82843bf1.pdf
    • http://www.floridaborncompany.com/uploads/1/3/0/7/130739286/5437117.pdf
    • http://alajmix.com/uploads/1/3/0/6/130639393/lovituxorugon-tixowe-nomorikaz.pdf
    • http://baycitymicivilairpatrol.com/uploads/1/3/0/6/130620334/nexeluxutaf_begubezevere_dubinevewowudow_vukidefisotekos.pdf
    • http://www.broomfieldmasonry.com/uploads/1/3/0/6/130620546/bekepolal.pdf
    • http://www.dejavumeridian.com/uploads/1/3/0/6/130605069/xutejeredi.pdf
    • http://www.kollekted.net/uploads/1/3/0/9/130968912/volabunuk.pdf
    • http://factprocessing.com/uploads/1/3/0/4/130483114/ef9aa323965b2f9.pdf
    • http://cbdusadistributors.com/uploads/1/3/0/8/130813320/24535b.pdf
    • http://factprocessing.com/uploads/1/3/0/4/130483114/ef9aa323
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007656.bin
3343f7919a649985800101be50a4ce0fab5248367c50a5b1a5c10a89a0ebf426		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7656 8452 bytes
font_01_sfnt_off000095a7.bin
afd8868629b61d85ec32a8a0de1ca84da82d48156cdd7447d7c4f51403cf5149		 pdf-font-stream PDF embedded font (sfnt) at offset 0x95A7 5244 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.