Malicious PDF — malware analysis report

Static analysis result for SHA-256 42228c28897ff775…

MALICIOUS

PDF

42.3 KB Created: 2020-04-06 12:19:04 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7654a4f19cd5d89d4cef7e4478546a19 SHA-1: 3190861d39391591e6b7840541b14286f0e0cbde SHA-256: 42228c28897ff775ed11ca50a38345958152790952dacdc5b846599bd548f629
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure related to treadmill adjustment, but its primary malicious function appears to be acting as a link farm. It embeds numerous URLs pointing to other PDF files hosted on various domains, likely intended to distribute malware or engage in SEO manipulation. The PDF_SEO_LINK_FARM heuristic firing confirms this behavior.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://victoriasaesthetics.net/uploads/1/3/0/5/130540219/130540219.html#how+to+adjust+belt+on+horizon+t101+treadmill
    • http://maddelleinegrae.com/uploads/1/3/0/2/130287506/bafigakipibev.pdf
    • http://peopleloveearth.org/uploads/1/3/0/4/130490928/nazixamesatesos_wijux.pdf
    • http://mkwbuildingservices.com/uploads/1/3/1/1/131164066/veruruxo_xopolorezujazi.pdf
    • http://originalpancakehousesavannah.com/uploads/1/3/0/9/130969891/ladowera-tisorim-suwiw.pdf
    • http://newyearsquebec.com/uploads/1/3/0/4/130436410/9d6789.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061cc.bin
5278024270de67705d3a5034a26ce2f5e1d9e53f50705cc770b2190155f81e7b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61CC 6728 bytes
font_01_sfnt_off0000726f.bin
e4ee204dc7b26c3cba38b0091ff7748dc50cdbac8ccec93137990c0dddd445c7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x726F 8328 bytes
font_02_sfnt_off00009274.bin
1efb75aff2b2ba777d3698612a5336b287f0b6d47a9c87ab35700670408a254f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9274 1948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.