Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b3554f87c6ccc70…

MALICIOUS

PDF

40.3 KB Created: 2020-03-06 17:11:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3a8a0ddbadfca0576c9d78501c85a390 SHA-1: b561a1ea51d77605b6d4aabe2f002f3dee5cabec SHA-256: 2b3554f87c6ccc709f8066982cc3ebbe50fd3751a14c077072a8259d7c2d8613
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous embedded URLs, many of which point to similarly structured domains and filenames, suggesting a link farm or SEO abuse tactic. The document body explicitly mentions "Free download pdf to jpg converter full version", indicating a lure to download potentially unwanted or malicious software. The presence of many external links and the nature of the lure strongly suggest a phishing or malware distribution attempt.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rockandrowel.com/uploads/1/3/0/7/130740521/130740521.html#free+download+pdf+to+jpg+converter+full+version
    • http://florablackettdesigns.com/uploads/1/3/0/4/130435947/7394574.pdf
    • http://adhdtransformation.com/uploads/1/3/0/7/130776562/xajerelupawasagatof.pdf
    • http://circumchange.ca/uploads/1/3/0/5/130551338/7317b2c.pdf
    • http://fischerfarmflowers.com/uploads/1/3/0/7/130740222/3079144.pdf
    • http://lafamiliaojeda.net/uploads/1/3/0/5/130590374/difavaka.pdf
    • http://advgs.com.my/uploads/1/3/0/6/130604820/4eebc7af99.pdf
    • http://mold-a-rama.net/uploads/1/3/0/6/130639462/6110369.pdf
    • http://lifestylestmarys.com/uploads/1/3/0/7/130739964/pugafab.pdf
    • http://acrespain.com/uploads/1/3/0/9/130969889/bawekuf.pdf
    • http://creativefitnesstalents.com/uploads/1/3/0/7/130775965/6710701.pdf
    • http://awpcmarianna.com/uploads/1/3/0/7/130775918/5860936.pdf
    • http://www.thepinktreasurebox.com/uploads/1/3/0/5/130543369/nusunegekew_dojifovomazedes.pdf
    • http://shop-perfectly-impressive-store.com/uploads/1/3/0/3/130379379/tobekaja_girub_wotuwekuziti_likasopomozi.pdf
    • http://www.florenceroadseitanist.com.au/uploads/1/3/0/6/130603789/sepulobiku_texoxisupil_zafoxedazinapop.pdf
    • http://www.amadorrunning.com/uploads/1/3/0/4/130476632/xekifavekumonim.pdf
    • http://www.livinlavidameraki.com/uploads/1/3/0/4/130483540/nefuzufoxiwi.pdf
    • http://richardkingham.com/uploads/1/3/0/5/130588257/5079279.pdf
    • http://lonsauto.com/uploads/1/3/0/2/130291779/nomasolinugukexiw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007647.bin
f141d567d631ddc5e5911aa9647e4cb33ea932f87550d491fa8acdb23d7532ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7647 7396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.