Malicious PDF — malware analysis report

Static analysis result for SHA-256 44296bd5f1c80fdc…

MALICIOUS

PDF

35.6 KB Created: 2020-03-22 03:42:37 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4f0eaf6e7a443254a2951b4accb3fa96 SHA-1: f8af2f5d6f6fe9ae86ede158a9dbddeabb65b078 SHA-256: 44296bd5f1c80fdc0a43c5d75b50c5ed2e83802942a0fec4be41ad29303dbe3d
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam tactic. The document body, though partially corrupted, contains text related to 'Ls dyna theory manual 2016', likely a lure to encourage clicks on the embedded URLs. The primary intent appears to be directing users to a network of websites, potentially for malicious redirection or phishing.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rofpe.com/uploads/1/3/0/6/130604501/130604501.html#ls+dyna+theory+manual+2016
    • http://morandoopress.com/uploads/1/3/0/5/130551599/sitadeb.pdf
    • http://nantcaw.co.uk/uploads/1/3/0/7/130776054/51ca3744c78a2.pdf
    • http://wendysglorybox.com/uploads/1/3/0/3/130324075/dezasubiwi-tijajaj-sejedipekur.pdf
    • http://root.biryanihouse.com/uploads/1/3/0/2/130289782/9788390.pdf
    • http://padovaservice.com/uploads/1/3/0/3/130313410/58baa26ec9b5.pdf
    • http://mta-sts.mx.happinessontherocks.com/uploads/1/3/0/3/130313176/pojafo.pdf
    • http://shine-bright-futures.com/uploads/1/3/0/9/130968963/2270978.pdf
    • http://www.a-backoffice.com/uploads/1/3/0/7/130774982/bujagewaw-vonagepukumegu-kusexubelum.pdf
    • http://heatherlavine.us/uploads/1/3/0/7/130776110/4013347.pdf
    • http://torontowaterfrontcondos4sale.com/uploads/1/3/1/1/131163774/9883430.pdf
    • http://thecellatlas.net/uploads/1/3/0/7/130776542/dubonesuko_bupubuvo_roxobizegukina_wijafegogaso.pdf
    • http://webmail.angelpractitioners.com/uploads/1/3/0/7/130739924/jutat-zuruwu-kinujurexekowo-bumop.pdf
    • http://greengatefarm.us/uploads/1/3/0/7/130738543/rojupamewebig_pobunapepuravef_bemerabaramudi_rovegezu.pdf
    • http://maghrebearthsolar.com/uploads/1/3/0/5/130590738/bajugamiwejevabeje.pdf
    • http://www.concert.mka-remix.com/uploads/1/3/0/7/130738814/a0fb9d88f01ec4.pdf
    • http://chloedo.com/uploads/1/3/0/6/130604416/saziwezefalazamelo.pdf
    • http://www.smartswimschool.com/uploads/1/3/0/4/130489241/ripifabibibamo.pdf
    • http://cncpwh.com/uploads/1/3/0/4/130483290/6878303.pdf
    • http://mediicepaks.com/uploads/1/3/0/5/130588687/aad941fd6e.pdf
    • http://youngretireetravel.com/uploads/1/3/0/5/130546290/puvodujuso.pdf
    • http://delucaconsulting.se/uploads/1/3/0/4/130476204/3153342.pdf
    • http://thetailsinn.com/uploads/1/3/0/7/130740221/2602167.pdf
    • http://mta-sts.vaniahair.com/uploads/1/3/0/5/130539215/3259735.pdf
    • http://byniamh.com/uploads/1/3/0/6/130640159/2994046.pdf
    • http://www.buttoncrush.net/uploads/1/3/0/5/130551184/23575511e3.pdf
    • http://mta-sts.vaniahair.com/uploads/1/3/0/5/130539215/3259735
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006497.bin
44d33e103bae40327e22d7227af2ca1726e9d0a18593a74b4acc1ac726ede8d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6497 7084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.