Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cb146f8bd881f14…

MALICIOUS

PDF

38.1 KB Created: 2020-04-11 21:55:39 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 60ed87bedd8389263c6ab9a80d3908c0 SHA-1: e33f259ddd39996d100cedc3bb7d12df23247260 SHA-256: 3cb146f8bd881f140085b84fc6be2c0ba122d8796a92d0d73564b21f6c3106d5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information T1204 Malicious Link

The PDF document contains a large number of external links to various domains, many of which follow a similar numeric or slug-based naming convention. This pattern is indicative of a link farm or SEO spam campaign. The document body, though partially corrupted, contains text related to 'Ejercicios de matematicas divertidos pdf' and wkhtmltopdf, suggesting a lure to disguise the malicious intent. The primary goal appears to be directing users to a network of potentially malicious or ad-filled websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://joshleephotojournalist.org/uploads/1/3/0/4/130483487/130483487.html#ejercicios+de+matematicas+divertidos+pdf
    • http://melaniebrynn.com/uploads/1/3/0/3/130324416/pegewizavu_fagezoson.pdf
    • http://ukbusinessradio.com/uploads/1/3/0/3/130313567/862815.pdf
    • http://theculturepassport.com/uploads/1/3/1/4/131406608/d3703d.pdf
    • http://skdurable.com/uploads/1/3/0/2/130288579/salupe.pdf
    • http://winerydestinationweddings.com/uploads/1/3/0/4/130483509/tepipixunibo.pdf
    • http://matildascookies.com/uploads/1/3/0/9/130969162/mixenodufeso_ninafifamor_zelupu.pdf
    • http://santicleaningservices.com/uploads/1/3/0/6/130639300/167ca3e08cb18b3.pdf
    • http://arizonaapartmentbrokers.com/uploads/1/3/1/3/131380786/31f07.pdf
    • http://sitarevoyance.com/uploads/1/3/0/7/130738951/889e82c809fa01.pdf
    • http://nikkinelsonmusic.com/uploads/1/3/0/5/130539336/nemufovofan_kaleroxiwis_kazid_setimozepovelet.pdf
    • http://jaymorganphilpot.com/uploads/1/3/0/7/130740251/xekiwugosafila.pdf
    • http://theartistscollective.us/uploads/1/3/0/4/130488539/8304294.pdf
    • http://matildascookies.com/uploads/1/3/0/9/130969162/mixenodufeso_ninafifamo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000693e.bin
d7bf18fda88678986c1ba6d308b3b949f9dfb2143f1ecb28946537ef61dfecc0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x693E 9160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.