Malicious PDF — malware analysis report

Static analysis result for SHA-256 4837d05929c3bf61…

MALICIOUS

PDF

36.6 KB Created: 2020-04-04 09:32:58 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 72060b03990e1bb235ceb803349ed536 SHA-1: 91e969fc6bfea1bb9a83cc7d82fc4ae85dcbe967 SHA-256: 4837d05929c3bf613e85a49ea8dabc289f3af41a2a3940a3c6d0cd73802496ca
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links pointing to various domains, many of which appear to be part of a link farm. The document body, though heavily obfuscated, contains a title related to children's poems in English and references wkhtmltopdf, suggesting it might be a lure. The primary heuristic firing indicates a 'PDF_SEO_LINK_FARM', suggesting the document's purpose is to link to a network of other PDFs. The IOCs are the URLs extracted from the document, which are likely used to redirect users to malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zpilatesmaui.com/uploads/1/3/0/4/130435922/130435922.html#poemas+de+la+naturaleza+en+ingles+para+ni%C3%B1os
    • http://sangamindianrestaurant.net/uploads/1/3/0/4/130490444/b9292d.pdf
    • http://metrostratareports.com.au/uploads/1/3/0/3/130324288/xidatunozutumud_badasidoti.pdf
    • http://lifewithdrones.com/uploads/1/3/0/7/130775752/tarison.pdf
    • http://therabbitholeofresearch.com/uploads/1/3/0/5/130588745/kuzesulebitawan.pdf
    • http://emgagedemo.com/uploads/1/3/0/7/130740124/zixujovubisu.pdf
    • http://jan4avl.com/uploads/1/3/0/7/130775619/3d5270a3f43e31f.pdf
    • http://elanabode.com/uploads/1/3/0/8/130874010/wasexegopap.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000641a.bin
52e48a821fb3a651850a17629f4e5b74ec4ac02070a73a3d60cbd9e38cb6dd04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x641A 8552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.