Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e3b6070fdfe1aa8…

MALICIOUS

PDF

29.3 KB Created: 2020-04-10 20:30:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 742d394189356059305d0265419df07c SHA-1: c340e052801c7a095816d04e0d3ecc55df41c124 SHA-256: 3e3b6070fdfe1aa8c057b6fcd4de7574b0fc8177334ce3eb5e7df052e45ce80e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document contains a lure related to watching a movie online, directing the user to a malicious URL. Additionally, it exhibits characteristics of a link farm, embedding numerous external links to other PDF files, likely for SEO manipulation or to distribute further malicious content. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://serafinaappel.com/uploads/1/3/0/8/130874128/130874128.html#watch+waterworld+online+free+full+movie
    • http://youngsforgbcs.com/uploads/1/3/0/4/130476687/riziwewezisiti.pdf
    • http://joyofstress.com/uploads/1/3/0/7/130776263/donekujidug-kexawidijojoju-xegoga.pdf
    • http://goblinworldjeans.com/uploads/1/3/0/5/130551154/sibixexuzojasivovido.pdf
    • http://pooveyconstruction.com/uploads/1/3/0/2/130289640/notemo.pdf
    • http://bdlecobuild.com/uploads/1/3/1/3/131380707/59aed33257.pdf
    • http://atlalasplace.com/uploads/1/3/0/7/130738989/5426430.pdf
    • http://executivesounds.com/uploads/1/3/1/3/131384021/jazop-xewetazer-morit-datexube.pdf
    • http://pro1inspection.com/uploads/1/3/1/4/131412713/1225098.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bf4.bin
a889a4de65d27eb38a6f8fc44f293dc3ea252f83845663aad5c4e324f3af7053		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BF4 7248 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.