Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cd884293cfe21e6…

MALICIOUS

PDF

49.8 KB Created: 2020-05-05 00:07:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8ec8ac153a5569710122827ed14f0e98 SHA-1: a8551c43e605ace801b33410852c88df62b08e84 SHA-256: 2cd884293cfe21e66a564b881d3d43df1169235c7021e5fbc5e21bfca38bf9a2
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF files hosted on various domains. This pattern is indicative of a link farm or a SEO poisoning attack, designed to drive traffic to these external resources. The document body itself is heavily obfuscated and contains metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://feel-well.org/uploads/1/3/0/8/130814588/130814588.html#arte+moderna+argan
    • http://leahhurd.com/uploads/1/3/0/2/130287837/fbe1a7b76d1.pdf
    • http://diamondsmartproducts.com/uploads/1/3/0/6/130620736/2700444.pdf
    • http://rubail.com/uploads/1/3/1/6/131637147/06b8a590df.pdf
    • http://www.vanbeekassociates.com/uploads/1/3/0/5/130551704/05cff2c2f6a68.pdf
    • http://thestarvingartistcookingshow.com/uploads/1/3/1/1/131164270/rodebix.pdf
    • http://samandnat.com/uploads/1/3/0/6/130603900/3444019.pdf
    • http://portrushheritagegroup.com/uploads/1/3/0/7/130740118/fanavumavopup-xufofufuwol-vapujesugi-takutigo.pdf
    • http://wing-shot.com/uploads/1/3/1/6/131606509/zotigo.pdf
    • http://mrshair.net/uploads/1/3/0/6/130620612/buler-gojemazikefap-regupaz.pdf
    • http://bestoftamarindo.com/uploads/1/3/0/6/130639283/6244506.pdf
    • http://dianebrowncolourspecialist.com/uploads/1/3/0/6/130620974/voluzapanuwazar.pdf
    • http://joestoptobottomhomeinspections.com/uploads/1/3/0/5/130588498/707500.pdf
    • http://gloriousgardens.net/uploads/1/3/0/8/130874261/zipofewotenike.pdf
    • http://eeneind.com/uploads/1/3/0/6/130605116/1685440.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009c4e.bin
6e4152a431246fdff6cc1f7e417df084ca4272e4009b71d34a8a884033bedd26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9C4E 9728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.