Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d34bb8ddb76bd58…

MALICIOUS

PDF

38.0 KB Created: 2020-04-20 13:17:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 94f24f79190e75f3e9d4cabe5e61e2d2 SHA-1: bc21e44b1d7d0ad827028c4acbca6f0d20adea8e SHA-256: 2d34bb8ddb76bd581e76af3963a7258885541e2d431f61c8954d4357b7f90722
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO spam operation. The document body is heavily obfuscated, but the presence of the URL http://abbenglish.com/uploads/1/3/0/4/130476135/130476135.html#le+scepticisme+pdf confirms the malicious intent of directing users to external content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://abbenglish.com/uploads/1/3/0/4/130476135/130476135.html#le+scepticisme+pdf
    • http://mooracrc.com/uploads/1/3/1/0/131071113/1740638.pdf
    • http://beresfordgroup.org/uploads/1/3/0/7/130776779/966a9333ec9a.pdf
    • http://wellingtonyogawithpenina.com/uploads/1/3/1/3/131380626/diravitosurewuw.pdf
    • http://28daycharitychallenge.com/uploads/1/3/0/7/130776508/e380e389.pdf
    • http://jump-services.com/uploads/1/3/0/7/130739835/vojakazifudabo.pdf
    • http://mybotoxboutique.com/uploads/1/3/0/7/130775971/kosisabofazugufevesa.pdf
    • http://psrglobal.net/uploads/1/3/0/2/130288542/vedurik_juwen.pdf
    • http://accjcsfund.org/uploads/1/3/0/6/130620275/8919368.pdf
    • http://better-business-works.com/uploads/1/3/1/4/131454090/2625511.pdf
    • http://axoneradio.net/uploads/1/3/0/6/130603763/c147add3ddd.pdf
    • http://dzwigal-instal.pl/uploads/1/3/0/4/130488387/safufelopapinuvojo.pdf
    • http://howardcountyrotaract.org/uploads/1/3/0/4/130436125/xowojawivadosat-sujamigixesulo-morofefot-fasafujux.pdf
    • http://civilwarfashionshow.com/uploads/1/3/0/3/130323535/3617ee72e187624.pdf
    • http://mail.srtk-9.com/uploads/1/3/0/8/130874162/8650e2b10.pdf
    • http://jlcsignatures.com/uploads/1/3/0/2/130289224/8b37cc626c5.pdf
    • http://jump-services.com/uploads/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067b4.bin
d71de292f0d7239b03b20bbed8c4d206b8db3da4154bf0a9857eefb21fb275b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67B4 10000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.