Malicious PDF — malware analysis report

Static analysis result for SHA-256 3105ec49e631cd98…

MALICIOUS

PDF

49.1 KB Created: 2020-04-02 01:19:57 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: fea581021512da875e59eb2807cd649a SHA-1: 346c4caf9ab2f80097305a018b0ffdb881a08565 SHA-256: 3105ec49e631cd989c84a91d003061e4fd5eb606e647928ab0d23fc696b82641
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of external links, many of which point to similarly structured URLs on different domains. The document body, though partially corrupted, suggests a lure related to 'Trabajos para niños de primer grado español' (Work for first-grade children Spanish). This indicates a likely attempt to drive traffic to a link farm or a phishing site disguised as educational content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://app-pof.com/uploads/1/3/0/7/130739962/130739962.html#trabajos+para+ni%C3%B1os+de+primer+grado+espa%C3%B1ol
    • http://polmaksondaj.com/uploads/1/3/0/8/130813429/xuwikaxa-nizujapa.pdf
    • http://aimpointprojects.com/uploads/1/3/0/6/130604955/digopakefalo_zavijo_gugakupilakif.pdf
    • http://cmrconstruction.org/uploads/1/3/0/6/130605335/0e81d1fc.pdf
    • http://accumentconsulting.com/uploads/1/3/0/5/130551058/ddf243b4.pdf
    • http://handcraftedwithlovebydeb.com/uploads/1/3/0/5/130545666/tinotupupawa.pdf
    • http://fivehard.com/uploads/1/3/0/2/130287808/6123987.pdf
    • http://oldschoolhiphopp.shop/uploads/1/3/1/1/131163854/6b75809c5543.pdf
    • http://cinfusions.com/uploads/1/3/0/7/130775589/xulike_dinepakajagimiv_kevizatezewijer_latufowuvi.pdf
    • http://southenddiving.co.uk/uploads/1/3/0/5/130550744/resigit-wegoju-govikax-bukefekodi.pdf
    • http://machmehrausdir.ch/uploads/1/3/0/5/130590295/1761266.pdf
    • http://mindinstitute.at/uploads/1/3/0/4/130475996/kitopiwap.pdf
    • http://movingfwdministries.org/uploads/1/3/0/5/130540040/wiralofa_fixulipuf_nizabo_kaguxiridalewe.pdf
    • http://finepointwedding.com/uploads/1/3/0/2/130291371/4943501.pdf
    • http://globalhealthhighschool.org/uploads/1/3/0/4/130436079/difozelorerutagizik.pdf
    • http://circuitdesyeux.net/uploads/1/3/1/4/131438177/c20f888303bc117.pdf
    • http://nmarphotog.com/uploads/1/3/0/7/130776185/402aff9a.pdf
    • http://zoomerman.net/uploads/1/3/0/4/130435884/83ff64.pdf
    • http://tlceducationalservices.com/uploads/1/3/0/6/130604090/geloleper-dafalabuburib-guxadepiva.pdf
    • http://emersonreunion.com/uploads/1/3/0/6/130639426/rakuvamodubu.pdf
    • http://vbhandsonmuseum.com/uploads/1/3/0/7/130775127/rinosunuxedekaki.pdf
    • http://determinedtolearn.org/uploads/1/3/0/2/130273913/9347314.pdf
    • http://lindaavolio.com/uploads/1/3/0/7/130740112/4408530.pdf
    • http://peteys.org/uploads/1/3/0/3/130312998/1650011.pdf
    • http://peteys.org/uploads/1/3/0/3/1303
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009414.bin
d7c919df386618252c5f8e55785b3d922f0103dd3e1d2a640389483a0e8ee947		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9414 8928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.