Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a1ab401c12aea31…

MALICIOUS

PDF

38.7 KB Created: 2020-03-27 07:59:06 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8011452b631704370accf94629188817 SHA-1: 8d51596cd36ae9410aabee7312c9e67d5e1cc3a3 SHA-256: 3a1ab401c12aea31dc9c9017eda159dcd86f120be2070acc9997cb03a19edafd
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO spam or to redirect users to malicious sites. The primary heuristic identified a link farm with 30 external PDF links hosted on `littlegreenwagon.com`. The document body contains text related to 'Nutrition dunkin donuts multigrain bagel' and metadata indicating it was generated by `wkhtmltopdf`, suggesting a lure document designed to appear legitimate while distributing links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bshppopup.com/uploads/1/3/0/9/130969471/130969471.html#nutrition+dunkin+donuts+multigrain+bagel
    • http://littlegreenwagon.com/uploads/1/3/0/8/130874601/zeletotumalimuz.pdf
    • http://timevessel.com/uploads/1/3/0/7/130738591/d7f69e7cb6.pdf
    • http://www.newlifedestination.com/uploads/1/3/0/7/130775214/wisipivexapuras-femigonuredigax-vuvusizetonuwut-jevex.pdf
    • http://kevcarez.com/uploads/1/3/0/8/130873984/6678362.pdf
    • http://www.domesticrcsupply.com/uploads/1/3/0/4/130436080/6996268.pdf
    • http://idigporn.com/uploads/1/3/0/5/130588437/povonizalek.pdf
    • http://jkconceptualart.com/uploads/1/3/0/5/130588962/83705d.pdf
    • http://lunchpong.club/uploads/1/3/0/4/130476672/wogasaduzupegivona.pdf
    • http://www.iamchanging75.com/uploads/1/3/0/6/130604488/507128.pdf
    • http://cogwinconstructors.com/uploads/1/3/0/4/130476033/3486680.pdf
    • http://youngatartmn.com/uploads/1/3/0/9/130969868/6793436.pdf
    • http://myworldharvestchurch.com/uploads/1/3/0/5/130541272/wikarapis.pdf
    • http://pilateswithkeira.com/uploads/1/3/0/2/130270951/vijezogigin.pdf
    • http://myrocketflow.com/uploads/1/3/0/8/130874488/24359b.pdf
    • http://matthewjacobi.com/uploads/1/3/0/4/130483900/novozaniwapudobibi.pdf
    • http://impactinstituut.org/uploads/1/3/0/6/130605504/sesumetilo.pdf
    • http://ready2mow.online/uploads/1/3/0/5/130588407/d9f6e6.pdf
    • http://themusicseo.com/uploads/1/3/0/7/130739026/4105594.pdf
    • http://patientkindinc.com/uploads/1/3/0/6/130603852/mapodogafegixo.pdf
    • http://updatemarketing.us/uploads/1/3/0/2/130289441/2975245.pdf
    • http://grapefuldregs.com/uploads/1/3/0/7/130775929/topuk.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e5a.bin
dfdb7b5b3b082fce4e37e3b54b8218f72eb25994e72a344aeddbbce8c4cdf0f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E5A 7892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.