Malicious PDF — malware analysis report

Static analysis result for SHA-256 366a79961be08d92…

MALICIOUS

PDF

40.1 KB Created: 2020-03-25 10:32:42 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8b3c3ec83201f80b832220ef1055f168 SHA-1: 75f00e142c8492327cc8c9265b2d7f37ec2af897 SHA-256: 366a79961be08d9203a90d58c3435db5262347726aeaff9c8d00dbdb6de1b077
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior. The document body contains garbled text and embedded URLs, reinforcing the nature of the sample as a link distribution mechanism. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uh-du.com/uploads/1/3/1/3/131379040/131379040.html#unidades+de+conversion+del+sistema+internacional+al+sistema+ingles
    • http://happypika.com/uploads/1/3/0/5/130551472/rifubakufujuxaz-vemagi-xividaw-degin.pdf
    • http://nanaglensolarfarm.com.au/uploads/1/3/0/3/130323748/gewevanavorobezojipe.pdf
    • http://www.floodhomerestoration.com/uploads/1/3/0/3/130313316/magevarejet-losunoluletudu.pdf
    • http://www.ha.holyangelsnj.org/uploads/1/3/0/5/130539412/pemozezejuke-vazanufe-ganinakes-xelofozatiti.pdf
    • http://flourishproductsandservices.co.uk/uploads/1/3/0/5/130550929/9362618.pdf
    • http://whynotoriginal.com/uploads/1/3/0/7/130739084/vemup.pdf
    • http://2eeautomation.com/uploads/1/3/0/2/130287296/jumenalar.pdf
    • http://thebaskamteam.com/uploads/1/3/0/7/130776640/niwoguwizupiza.pdf
    • http://mooderopah.com/uploads/1/3/0/6/130605339/6b09d3eec1d.pdf
    • http://pleasureisnotasin.com/uploads/1/3/0/7/130776745/dfefd341.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000067ad.bin
eb9270bfe825518741195bea36aec8be4bd0d03874e45be2bbf3ef576fede545		 pdf-font-stream PDF embedded font (sfnt) at offset 0x67AD 8580 bytes
font_01_sfnt_off00008693.bin
cfb3357b20fb01955c1e4a0ed568c791e3a97db8f0fbaa18432a833eaa1d19da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8693 2828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.