Malicious PDF — malware analysis report

Static analysis result for SHA-256 35999f03f9505db8…

MALICIOUS

PDF

36.2 KB Created: 2020-04-06 09:13:47 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6d7bbd3810953d5c6bad61400d3e1f8c SHA-1: e99d387eec5d30789f3de734173c8e7d7118f0d2 SHA-256: 35999f03f9505db862497b299a03baf73589d23ed60ba269faa4e78c73cf3c8a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The document body, though partially corrupted, suggests a lure related to a book introduction. The heuristic 'PDF_SEO_LINK_FARM' indicates a high volume of such links, pointing towards a malicious intent to distribute or host harmful content across multiple domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miriamhjewelry.com/uploads/1/3/0/8/130813604/130813604.html#a+brief+introduction+to+the+new+testament+bart+ehrman
    • http://hgfnow.com/uploads/1/3/0/3/130313433/0ecd1cf568.pdf
    • http://sophiashair.com/uploads/1/3/0/8/130813111/tuxagezikutor.pdf
    • http://algesiology.com/uploads/1/3/0/8/130873951/6878915.pdf
    • http://stlbluesviews.com/uploads/1/3/0/6/130621867/55264548.pdf
    • http://testmyowl.com/uploads/1/3/0/6/130604319/7c432c64b.pdf
    • http://coverage4bikers.com/uploads/1/3/1/4/131437061/1472286.pdf
    • http://hapuswales.net/uploads/1/3/1/4/131408024/fezunaliwaxivebexexo.pdf
    • http://mylifebuilder.org/uploads/1/3/0/2/130289179/temoradonibufom.pdf
    • http://visionbystin.com/uploads/1/3/0/8/130874646/ca3c2c9b.pdf
    • http://johnsonwildlifeservices.org/uploads/1/3/0/5/130543310/e0a4b1d.pdf
    • http://birminghampropainters.com/uploads/1/3/0/5/130539053/5c484a63d82a39e.pdf
    • http://avamediainc.com/uploads/1/3/0/8/130814126/wugolip_sumobofeve_xijivifisasoma_ruwegepuzazofe.pdf
    • http://poulsbonotary.com/uploads/1/3/0/6/130604335/5522732.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000065ef.bin
0c9bf55342b395b81cd1277097178381181f4993fc990ceccfbf01a98453b907		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65EF 7464 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.