Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dbea0561bef2774…

MALICIOUS

PDF

101.5 KB Created: 2020-04-16 12:53:42 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8e7d099473d66b2e6d8d015cdb05897a SHA-1: 07857f2f404d19796a6f4a4ccf719c2e50cc00ed SHA-256: 2dbea0561bef277442ac92b6a5ea046ed0d1cd570f29951a339ed1347ff78f33
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, many of which point to other PDF files on various domains, suggesting a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains the string "Yakuza mahjong guide", which is likely a lure to attract users to click on the embedded links. The primary malicious activity appears to be directing users to external websites, potentially for further exploitation or malware delivery.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jjtautomotorrepair.com/uploads/1/3/0/8/130813804/130813804.html#yakuza+mahjong+guide
    • http://mogairsolutions.net/uploads/1/3/0/6/130620789/9042558.pdf
    • http://toss.social/uploads/1/3/0/5/130588843/torufavizomukuk-xosedexomoni.pdf
    • http://hatcherpassweddings.com/uploads/1/3/0/7/130775306/4647149.pdf
    • http://signagedude.com/uploads/1/3/0/6/130604856/6368877.pdf
    • http://twin-cs.org/uploads/1/3/1/3/131384531/49582f39d0f57.pdf
    • http://northamericanimamsfederation.org/uploads/1/3/0/7/130775291/8719100.pdf
    • http://townsontowelsandlinen.com/uploads/1/3/0/4/130483350/df6cd476eaa2382.pdf
    • http://etwla.com/uploads/1/3/1/4/131406438/kofuzedud.pdf
    • http://beerimbiber.com/uploads/1/3/0/2/130270974/302220.pdf
    • http://sole-bed-and-breakfast-agropoli.com/uploads/1/3/0/8/130814133/binexabiwekenovituko.pdf
    • http://jandjcleaningco.com/uploads/1/3/0/4/130435631/zuwizaxapumowonuj.pdf
    • http://whiteowlcolorstudio.com/uploads/1/3/0/8/130874672/5362252.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001032f.bin
7aa8ae779f00018f078386f7740540166b5299ab3fcf064c67921bf68dcebecd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1032F 8536 bytes
font_01_sfnt_off000122e6.bin
b44edbc9241f7b9ed65a22a4ef67c391dfbe529635722dd8b8923ae3cfd91fb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122E6 32468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.