Malicious PDF — malware analysis report

Static analysis result for SHA-256 3aa64ac58403a80b…

MALICIOUS

PDF

40.9 KB Created: 2020-04-03 09:31:44 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5eecc1f71942bb6552fef8885bcee359 SHA-1: fd4cd2dcea8d7e0e2949665b3b773a6670d633a6 SHA-256: 3aa64ac58403a80bed80431e76cd3f99d688f57d722368cee9b43edee5545728
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or redirection scheme. The document body contains text related to 'monografia' and 'caracteristicas', which appears to be a lure to disguise the malicious intent of directing users to numerous external URLs. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://churchstrettontaxi.com/uploads/1/3/0/6/130620402/130620402.html#concepto+de+monografia+y+sus+caracteristicas
    • http://dustynichols.com/uploads/1/3/0/7/130775242/fifegedunivel-sadamoxi-banuda-wobexokolamamu.pdf
    • http://kelsyreitzevents.com/uploads/1/3/0/5/130588624/8569564.pdf
    • http://hairtherapy413.com/uploads/1/3/0/2/130289443/sasimogifanono.pdf
    • http://compassionatelivingcourse.com/uploads/1/3/0/3/130323412/vizuziwotuz.pdf
    • http://saldiday.com/uploads/1/3/0/2/130287872/667532.pdf
    • http://charlesheiner.net/uploads/1/3/0/6/130604858/mizilafufukoge.pdf
    • http://stonefoxfeather.com/uploads/1/3/0/7/130739711/f844b1156.pdf
    • http://rycagear.com/uploads/1/3/1/1/131163492/5543291.pdf
    • http://space4.international/uploads/1/3/0/6/130604576/1661057.pdf
    • http://salonentro.com/uploads/1/3/0/2/130289773/zigop.pdf
    • http://jess-portfolio.com/uploads/1/3/0/3/130379210/ripivijidizo.pdf
    • http://playkhssr.xyz/uploads/1/3/0/4/130435891/fodegemap.pdf
    • http://cprservicesusa.com/uploads/1/3/0/8/130815351/wipofur.pdf
    • http://youth2seniors.info/uploads/1/3/0/3/130323542/xaxofixetujer.pdf
    • http://enricorobusti.com/uploads/1/3/0/7/130776338/lufibususipep-dajizofegoxa.pdf
    • http://nelsonbeatsthedrums.com/uploads/1/3/0/6/130605432/7868133.pdf
    • http://livforusa.com/uploads/1/3/1/0/131070044/bazoludeb.pdf
    • http://springs4houstongaragedoors.com/uploads/1/3/0/6/130621873/8dbfb3924cc97c.pdf
    • http://pittsburghhairsalons.com/uploads/1/3/0/7/130775936/1323454.pdf
    • http://thoughtsfromnowhere.com/uploads/1/3/0/5/130540683/suriganusexexuz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000754d.bin
5936b21c0cf00c88011bf45b5ce9bfc828d7cf80e9f4604b74135c56fc2c8a7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x754D 8372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.