Malicious PDF — malware analysis report

Static analysis result for SHA-256 40b2d0a44b2e2eb2…

MALICIOUS

PDF

40.2 KB Created: 2020-05-13 04:51:15 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 901b3791feda113e95516dc90a180740 SHA-1: 1f24b0b13f5262f850ce5bd13559e66106c570be SHA-256: 40b2d0a44b2e2eb28cad36d39a0bfd84efea3467bf1e6b4f53101dd9173ada2a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which are structured to appear as SEO-optimized content, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, contains text related to 'Etfe material data sheet' and includes the same URLs found in the heuristics. This indicates a likely attempt to drive traffic to malicious or compromised websites under the guise of providing technical documentation.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cugnette.fr/uploads/1/3/1/1/131164297/131164297.html#etfe+material+data+sheet
    • http://bullpencomics.com/uploads/1/3/0/9/130969714/a09efb7a7.pdf
    • http://shaketheband.com/uploads/1/3/0/9/130969375/raguvojuvut_lajozaba_gozaku_patalefulisafop.pdf
    • http://barberbunch.us/uploads/1/3/1/4/131410434/57336344a.pdf
    • http://1dominionhomehealthcare.com/uploads/1/3/1/8/131856632/c19444de62f93dd.pdf
    • http://silveretconline.com/uploads/1/3/0/6/130639643/7ebcafb.pdf
    • http://sfiles.net/uploads/1/3/0/4/130478067/48f0745fa008c2.pdf
    • http://novellicompetizione.com/uploads/1/3/1/4/131454190/judoxo.pdf
    • http://zellf.nl/uploads/1/3/0/2/130287311/kubofenufe.pdf
    • http://pamelagallagher.com/uploads/1/3/0/6/130620459/turuk_bapisa_xezejox.pdf
    • http://longmeadowlamps.net/uploads/1/3/0/5/130590351/9811153.pdf
    • http://shamanwithin.net/uploads/1/3/0/5/130543099/8d282e80.pdf
    • http://genevievewilson.co/uploads/1/3/0/7/130739916/jinozuvaji-vusopuwege-vulesosokilab.pdf
    • http://dirtyhtml.com/uploads/1/3/1/4/131413678/babenajadasabo_fesageze_gosapaxoxujus_sinisimeluvuke.pdf
    • http://trekkerapp.net/uploads/1/3/0/4/130488590/b30b5f.pdf
    • http://prisonblogmedia.com/uploads/1/3/0/6/130604639/vovikabe_didupozevat_faragorefogip.pdf
    • http://amazonmining.org/uploads/1/3/1/4/131407135/sakoxigo_tenimolelub_xisesapeledada_doboruwefufis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006f55.bin
b57fbc055dc23e3fd2cc451ce49210ff21462e197f1c5ef60afad8bb3af36320		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F55 11056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.