Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d451bae50d5acd1…

MALICIOUS

PDF

41.0 KB Created: 2020-03-30 17:54:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 947d18f4ce3747335a8071acf24f2bfa SHA-1: 20b0a65a8d0e0f455bda038db516270c79fc205d SHA-256: 2d451bae50d5acd1f137cd209b13847156b65d7457b64244f84813a359ac4063
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is designed to appear as a search result for free drivers, likely as a lure to trick users into clicking on the numerous embedded links. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, suggesting a link farm or redirection mechanism. The primary URL found in the document body is also included as an IOC.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sandyguillot.com/uploads/1/3/0/2/130291838/130291838.html#dell+inspiron+n5040+drivers+for+windows+7+32+bit+free+download
    • http://hensleycartage.com/uploads/1/3/0/7/130775607/934d031724182c.pdf
    • http://downforacure.org/uploads/1/3/0/3/130323157/c9b122afb616942.pdf
    • http://yousurecan.com/uploads/1/3/0/7/130740385/6582656.pdf
    • http://www.vanesanieri.com/uploads/1/3/1/1/131163878/salaperaritokitixuju.pdf
    • http://homteamdesign.com/uploads/1/3/0/7/130774964/xagexifakavimip.pdf
    • http://bossasrx.com/uploads/1/3/1/3/131379948/48d0dfb432d565.pdf
    • http://frankfortinc.com/uploads/1/3/0/5/130546183/3470741.pdf
    • http://chatterdoodle.com/uploads/1/3/0/8/130813577/ranivugotikajaj.pdf
    • http://adamaslam.com/uploads/1/3/0/7/130775962/luxifisefufezakavu.pdf
    • http://forethekidsfallclassic.com/uploads/1/3/1/0/131070330/3576098.pdf
    • http://leighaburnham.com/uploads/1/3/0/6/130605244/4554052.pdf
    • http://nomlondon.com/uploads/1/3/0/2/130289754/nutij.pdf
    • http://ramblingsinthewilderness.com/uploads/1/3/1/3/131380171/logegijinabexa_denum_nojatetuguvigus_nomafapimuk.pdf
    • http://partij-neeleman.nl/uploads/1/3/0/3/130379150/jonobibisa_karulewezo_zuxipefojokesuf.pdf
    • http://kevgriggfitness.com/uploads/1/3/0/5/130551237/649429.pdf
    • http://restorationexpeditions.com/uploads/1/3/0/9/130969449/cb54c45.pdf
    • http://spokanefamilyheritagevideos.com/uploads/1/3/0/6/130605116/kuxenix_pomumexidik_kagas_lavele.pdf
    • http://caricaturesbysimon.com/uploads/1/3/0/5/130545684/9364857.pdf
    • http://simplecity.us/uploads/1/3/0/8/130814763/mapinilixojike-nevinova-naluberukuxinuz-janalud.pdf
    • http://giannanicolesheartofhope.com/uploads/1/3/0/8/130814353/5721c9587c0.pdf
    • http://jonjuneau.com/uploads/1/3/1/1/131164113/wopurew.pdf
    • http://zenocse.com/uploads/1/3/0/8/130874289/8187080.pdf
    • http://sportsdreamjob.com/uploads/1/3/1/3/131379041/bibimi-navamijim.pdf
    • http://sportsdreamjob.com/upl
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000076be.bin
7cb91f3a1cae6007ebab8d028b4ce87e390ce89d035156bd2c1b6e29c74d7d35		 pdf-font-stream PDF embedded font (sfnt) at offset 0x76BE 7900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.