Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ed3bbd292db140d…

MALICIOUS

PDF

33.1 KB Created: 2020-04-26 03:54:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7b0df76171a946f82fa2b197de62ee12 SHA-1: cf4326ae072225f6384d3b1df3d288f1fd4c9133 SHA-256: 3ed3bbd292db140df65ec6351a87967d9b71dd1844404fa3f0a50832b52a36af
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits characteristics of a link farm, with numerous embedded external URLs pointing to various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, suggesting a non-standard document purpose. While no scripts were extracted, the sheer volume of external links, including one that appears to be a direct reference to a song title, points towards an attempt to manipulate search engine results or distribute content through a large number of seemingly unrelated pages. The primary attack pattern is likely related to SEO manipulation or content distribution rather than direct exploitation.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deliciousbeard.com/uploads/1/3/0/4/130483300/130483300.html#bekhayali+song+female+voice
    • http://roughedges.net/uploads/1/3/1/4/131453733/zamiwuligijerebopexe.pdf
    • http://texasqualitybengals.com/uploads/1/3/0/8/130873975/jupemesorunelife.pdf
    • http://ilanaleberdesignfolio.com/uploads/1/3/0/4/130435577/gusoz-pevevodugebaxu-mobosuraviforo.pdf
    • http://bloomcoaching.net/uploads/1/3/0/6/130605143/9440348.pdf
    • http://equestrianeliteatapplejackfarm.com/uploads/1/3/0/5/130542920/6926328.pdf
    • http://bhavisheythapar.com/uploads/1/3/0/7/130739094/nilaz-merefatebumije-lagidet.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005952.bin
6fab39752959becf04413eafa2c64dd792e048691975c5ea932602da16d9cb6c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5952 8220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.