Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dd45d5c64195f3a…

MALICIOUS

PDF

47.2 KB Created: 2020-04-16 07:06:52 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4855a53073f5ee997625b1833b7c3e3b SHA-1: abef9d672b7544251586d9261bcf4e71727a0390 SHA-256: 2dd45d5c64195f3ac668119b1000a7c93c331f3d51a0c89b6b01933b5810675e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. One of these links, http://theclassyandjazzyboutique.com/uploads/1/3/0/9/130969432/130969432.html#boboiboy+solar+song, is also present in the document body, suggesting a deliberate attempt to redirect users. The presence of numerous similar PDF files across different domains indicates a likely SEO spam or link-farming operation.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theclassyandjazzyboutique.com/uploads/1/3/0/9/130969432/130969432.html#boboiboy+solar+song
    • http://ocriverfest.com/uploads/1/3/0/5/130539496/8887165.pdf
    • http://wagerwear.net/uploads/1/3/1/3/131383543/wizijenimowepa-resowuga-guxozi.pdf
    • http://francinebeaudin.com/uploads/1/3/1/3/131379183/a8ab7968.pdf
    • http://apbmedia.com/uploads/1/3/0/7/130739867/5125419.pdf
    • http://jjsbarkarnak.net/uploads/1/3/0/4/130477036/3946517.pdf
    • http://rosavegabakery.com/uploads/1/3/0/5/130588913/1915014.pdf
    • http://mirkogablerviolins.com/uploads/1/3/0/4/130435706/suxokusupixewimuv.pdf
    • http://trinastreasurecove.shop/uploads/1/3/0/4/130488736/sugurejodod.pdf
    • http://browndudley.com/uploads/1/3/0/6/130603793/lenobuzeke_wupatipewesali_lazuvunerajaru_wenupusefov.pdf
    • http://localmarketinghub.net/uploads/1/3/0/6/130604864/6363304.pdf
    • http://preview.spapelle.com/uploads/1/3/1/6/131606179/kezixikiwabitus-nawexovevev-vakalenij-xixurofego.pdf
    • http://lgbtq-kc.com/uploads/1/3/0/4/130476671/4289572.pdf
    • http://fet4life.net/uploads/1/3/0/6/130604988/ff427e6924ff.pdf
    • http://furrybabydepot.net/uploads/1/3/1/3/131379384/3053587.pdf
    • http://discovery-workshop.com/uploads/1/3/0/7/130776374/guwizisaxub_kedazadagibibev_wasuteb_gegemakixera.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000082df.bin
e80d9f77e69ce4ec864880c8764179c18844ff79f19d86dd743f39e30d2832b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x82DF 7984 bytes
font_01_sfnt_off0000a163.bin
d676ad402555027b8a687dd2c83e14150b7e752604a9fa09ca22e62eb3274c0c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA163 4652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.