Malicious PDF — malware analysis report

Static analysis result for SHA-256 3507ba3ae949d797…

MALICIOUS

PDF

50.5 KB Created: 2020-04-02 07:14:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: d71a127ef2f147a5f1af4592420a890f SHA-1: cf7abae333c4ad092bb8b620914d54fa3e8ef152 SHA-256: 3507ba3ae949d7973e27e961669747221c3c1752efbdee2213dc123e85141d29
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, many of which point to similarly structured URLs on various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, suggesting a malicious intent to redirect users. The presence of a 'download button' lure further supports this, implying the document is designed to trick users into clicking these links. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dapperkings.club/uploads/1/3/0/7/130776143/130776143.html#fathered+by+god+pdf
    • http://simplychrissyk.com/uploads/1/3/0/6/130605369/e80c3d8d2d465c8.pdf
    • http://affordablevisualconcepts.com/uploads/1/3/0/8/130874601/xijud.pdf
    • http://streamlineevents.net/uploads/1/3/0/2/130272350/ludago_kasuxawodasofe_luxivol_moburexekis.pdf
    • http://loveforchinese.com/uploads/1/3/0/6/130621510/madivogomupotu.pdf
    • http://danieljameshughes.com/uploads/1/3/0/5/130544072/gatafuven-paxotudafo-sizeze.pdf
    • http://maryleezawadski.com/uploads/1/3/0/7/130776040/zinozowejed-gurepofuzujof-zimatikatuj.pdf
    • http://higherselfcounseling.com/uploads/1/3/0/6/130620305/cd7da4de70a3a.pdf
    • http://cvidigalcookering.com/uploads/1/3/1/1/131164238/xilopomugomuja_mibizewubili_vofetepupisel.pdf
    • http://breadandbooze.com/uploads/1/3/0/7/130738893/nekak.pdf
    • http://ninety-percent.com/uploads/1/3/1/3/131379608/5259469.pdf
    • http://chelsealubs.com/uploads/1/3/1/3/131382028/letiwezevola.pdf
    • http://bestdealvacations.com/uploads/1/3/0/6/130621057/lagenupe.pdf
    • http://fossilsounds.net/uploads/1/3/0/8/130813612/tafilopezarul.pdf
    • http://baakboutique.com/uploads/1/3/1/0/131070307/pawetekifijidowibu.pdf
    • http://valestingrayscience.com/uploads/1/3/0/5/130544134/9a0ab9d59e.pdf
    • http://2asm.net/uploads/1/3/0/2/130270812/3528574.pdf
    • http://ogballers.org/uploads/1/3/0/5/130551364/3841346.pdf
    • http://internetofne.com/uploads/1/3/0/7/130739964/2233370.pdf
    • http://waycoolerthanazoo.com/uploads/1/3/0/8/130874023/5629324.pdf
    • http://vantagemanagement.net/uploads/1/3/0/5/130544390/4843459.pdf
    • http://topneurosurgery.com/uploads/1/3/0/5/130551749/pamipifusewulux.pdf
    • http://ttcuniversitydays.com/uploads/1/3/0/9/130969214/pafepegi_gutilonok_ditojex_zafelumewebuda.pdf
    • http://valerieainsworthcounseling.com/uploads/1/3/1/4/131453127/podajadagezewe_kelemovoxubajow_sujulob.pdf
    • http://valerieainsworthcounseling.com/uploads/1/3/1/4/131453127/podajadagezewe_kelemovoxubajow_sujulob.p
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009b1c.bin
04a1edccb7e60cebcef05f3dd6d514dfe30613ad14daa471f053fd24eabd781e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B1C 9208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.