Malicious PDF — malware analysis report

Static analysis result for SHA-256 395e5581881debcc…

MALICIOUS

PDF

33.1 KB Created: 2020-03-22 10:53:07 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8362a456dff2cee36ba631449c975245 SHA-1: 3ded9370002b84f48f7fc0edceb9a1607daa2807 SHA-256: 395e5581881debccf48d0cabefa8533b2ba56295d258a75646e63e939e3da713
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO spam campaign, likely intended to drive traffic or distribute further malicious content. The document body contains text related to SQL Server, which may be a lure to attract specific users. No scripts were extracted, and the primary malicious activity observed is the distribution of numerous external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://taamaintenancesolutionsllc.com/uploads/1/3/0/7/130774977/130774977.html#crear+vistas+sql+server+2008+con+parametros
    • http://michiganpc.org/uploads/1/3/0/5/130544387/tixodi.pdf
    • http://chunkeymonkey40.com/uploads/1/3/0/3/130313213/kuwemisoforamikal.pdf
    • http://robshadow.com/uploads/1/3/0/3/130313686/dcc4c51b2c2cd6.pdf
    • http://directtoullc.com/uploads/1/3/0/6/130604911/9368614.pdf
    • http://notanotherpotcast.net/uploads/1/3/0/6/130621838/449a5152ffe98.pdf
    • http://smph.agency/uploads/1/3/0/8/130873838/lepezarezose.pdf
    • http://neneliciouslingerie.com/uploads/1/3/0/8/130874063/dibazadazinoxakopobi.pdf
    • http://www.veganizedconsulting.com/uploads/1/3/0/8/130873810/satunaguf.pdf
    • http://evergreenmortgagenotes.com/uploads/1/3/0/6/130604140/6428a6f.pdf
    • http://mydigitalpresence.com/uploads/1/3/0/6/130604421/4759743.pdf
    • http://michellejfernandez.com/uploads/1/3/0/2/130274368/miniledin.pdf
    • http://chincoganmowers.com/uploads/1/3/0/8/130814728/8778508.pdf
    • http://www.rhbconstructorainmobiliariasrl.com/uploads/1/3/1/0/131070852/puvavex_sawurajo_dakavum_vamusuge.pdf
    • http://align2015.com/uploads/1/3/0/4/130489122/7156335.pdf
    • http://geriatricmodelingclub.com/uploads/1/3/0/7/130775911/sewifatexuledezox.pdf
    • http://learninginspirations.org/uploads/1/3/0/5/130547999/fopunulagefori.pdf
    • http://holacaffee.com/uploads/1/3/0/8/130813913/60972b44c0e0.pdf
    • http://mizzenmanagement.com/uploads/1/3/0/6/130620976/9444829.pdf
    • http://ombeat.app/uploads/1/3/0/3/130323491/rokefawade.pdf
    • http://cevapciciusa.com/uploads/1/3/0/6/130620217/462284.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005950.bin
0e48ed374809a0ef63de0277c96a9d7e60ea244234a516e2171b3f2fcad9c864		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5950 7556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.