Malicious PDF — malware analysis report

Static analysis result for SHA-256 2eccf32e64887c9e…

MALICIOUS

PDF

60.2 KB Created: 2020-04-10 09:51:32 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5c20db286f1b582212cbeb9ce26ac4de SHA-1: f858f809c43fc5866cf0ea386982442302769a28 SHA-256: 2eccf32e64887c9eadc721b58d61f0120ce8f596fe2d58643fdbaa0fe3dd6ea0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similar domains. The document body text, though partially corrupted, includes a medical-sounding title, suggesting a lure to attract users to these external sites. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shift-it-transmissions.com/uploads/1/3/0/4/130483507/130483507.html#tratamiento+de+la+cetoacidosis+diabetica+en+pediatria+pdf
    • http://constructbids.com/uploads/1/3/0/3/130313191/5287551.pdf
    • http://sequimhometeam.com/uploads/1/3/0/8/130873801/gefiw.pdf
    • http://kemptvillelandandsea.com/uploads/1/3/0/5/130550938/4777047.pdf
    • http://duannapang.com/uploads/1/3/0/5/130542727/721862ee26e.pdf
    • http://lori-annspeed.org/uploads/1/3/0/6/130621164/dotarizoturamegub.pdf
    • http://secondtimeroundautoparts.com/uploads/1/3/1/4/131483083/nofon_fitagef.pdf
    • http://636leather.com/uploads/1/3/0/3/130313038/5726985.pdf
    • http://wearecvsta.net/uploads/1/3/0/7/130776138/butenurowudipikato.pdf
    • http://onsiterepairs.info/uploads/1/3/0/6/130620522/jabirasubamebub-susuxux-zegipadap-nozewanowof.pdf
    • http://tonyascottcakes.com/uploads/1/3/0/6/130604710/8794034.pdf
    • http://akrewards.com/uploads/1/3/0/6/130621167/3bfdf3.pdf
    • http://mazatlantravelclub.net/uploads/1/3/0/3/130323227/5404888.pdf
    • http://kicksmasteronline.com/uploads/1/3/0/5/130543156/tojivinikapejafu.pdf
    • http://austinsandford.com/uploads/1/3/0/6/130639574/530506.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c016.bin
39910304b69f4da61d68e6a2d24da22ae95dca69175fcc8b8a5f3072cb1c955c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC016 9300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.