Malicious PDF — malware analysis report

Static analysis result for SHA-256 4638b48d137db49d…

MALICIOUS

PDF

42.5 KB Created: 2020-03-26 07:13:14 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7d811327d7e66dda562caab1733387a1 SHA-1: 534077e74e48c0ec9d8e76ee6f97c5f884f7bb82 SHA-256: 4638b48d137db49d8006b0e00813578de3697b9362e88f479b2662e05e24f961
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The document body text is largely garbled, but the presence of the URL 'http://msplantdiv4.com/uploads/1/3/0/6/130639803/130639803.html#cuanto+demora+un+cultivo+de+sangre' suggests a lure related to medical tests. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates a malicious intent to generate traffic or distribute further payloads via these links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://msplantdiv4.com/uploads/1/3/0/6/130639803/130639803.html#cuanto+demora+un+cultivo+de+sangre
    • http://www.agirlwithcoffee.com/uploads/1/3/0/5/130550885/29480fc76.pdf
    • http://remote.diducalaw.com/uploads/1/3/0/2/130287929/wexifu.pdf
    • http://andrewspickert.com/uploads/1/3/0/6/130639510/68f57925.pdf
    • http://whatgenami.com/uploads/1/3/0/2/130271108/50021d2.pdf
    • http://marayiti.org/uploads/1/3/0/2/130288768/b20fb4f5c5cc53.pdf
    • http://mail.fredrikforslund.com/uploads/1/3/0/5/130543980/6084481.pdf
    • http://thepgproject.com/uploads/1/3/0/6/130604678/2496601.pdf
    • http://amplifyprintsolutions.com/uploads/1/3/0/5/130589102/firapeluxones.pdf
    • http://centroccc.org/uploads/1/3/0/6/130603760/lugawafoxosez.pdf
    • http://cryptifer.com/uploads/1/3/0/4/130488539/mogaxetejuwepo-gubukaz-xaxifow-kowitinom.pdf
    • http://www.yanntheveniaudmariages.com/uploads/1/3/0/2/130271190/c71cceee440b5.pdf
    • http://anappleatdawn.com/uploads/1/3/0/7/130776151/nivinok-woxijimegape-kaxupale.pdf
    • http://weekswritingwilderness.com/uploads/1/3/0/6/130620391/f1bd8b6ef5b5d.pdf
    • http://singletonstreats.com/uploads/1/3/0/9/130969830/zusufenoj_lututukotir_pizin_fajibisuxebidis.pdf
    • http://www.babuni.ca/uploads/1/3/0/5/130542909/fibuvejox.pdf
    • http://edudesignaddict.com/uploads/1/3/0/9/130969717/dukasuz_xalom.pdf
    • http://sophiajamal.com/uploads/1/3/0/4/130488169/gopolavevitenun.pdf
    • http://kitchenremodelokc.com/uploads/1/3/0/7/130739156/gajedunujoxar.pdf
    • http://gemifyyourlife.com/uploads/1/3/0/2/130272493/8567367.pdf
    • http://nadinebrockel.de/uploads/1/3/0/4/130476624/goneraselepone.pdf
    • http://fusheng-life.com/uploads/1/3/0/4/130483753/5971916.pdf
    • http://chantamoore.com/uploads/1/3/0/2/130288753/262fd163c.pdf
    • http://michelle-leach.com/uploads/1/3/0/7/130739578/5173da60aab.pdf
    • http://lynnxiao.com/uploads/1/3/0/7/130776607/diwidizow.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b0e.bin
1072d523aa460bb5afe70f42a91694f821056910260df09a1bb85c0db80ea847		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B0E 8612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.