Malicious PDF — malware analysis report

Static analysis result for SHA-256 48b7a858232036b8…

MALICIOUS

PDF

42.9 KB Created: 2020-04-05 08:33:29 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 795b2c453a6ca54b48b78bf545054201 SHA-1: 161aaee1c64303a863e040bd58d7575d3319e0e0 SHA-256: 48b7a858232036b89a629e1daed8e5aa1e33159e19a129f5e993afa4649f17cb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similarly structured domains. This suggests a link farm or SEO poisoning tactic designed to drive traffic to these sites. The primary URL found in the document body is http://snakeriversmallbatchjerkyco.com/uploads/1/3/0/6/130605270/130605270.html#listado+de+dispositivos+de+entrada+y+salida+del+computador, which is part of this network.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://snakeriversmallbatchjerkyco.com/uploads/1/3/0/6/130605270/130605270.html#listado+de+dispositivos+de+entrada+y+salida+del+computador
    • http://qualitypropertiesllc.net/uploads/1/3/0/6/130604168/ae717f2b6afde4.pdf
    • http://navigatelifetransitions.com/uploads/1/3/0/7/130776444/225608.pdf
    • http://doctorsrogers.com/uploads/1/3/0/3/130323547/484926.pdf
    • http://socalecoblasting.com/uploads/1/3/0/4/130476709/zogevafitimo.pdf
    • http://autournantdelile.com/uploads/1/3/0/6/130640094/2037908.pdf
    • http://rbarti.com/uploads/1/3/0/6/130604798/jotufojupenasigonog.pdf
    • http://amelionunez0.com/uploads/1/3/0/7/130775842/fisusovalomuj.pdf
    • http://mellagold.com/uploads/1/3/1/0/131070566/25943c2fe202.pdf
    • http://tdcllc.us/uploads/1/3/0/6/130620811/2945151.pdf
    • http://brewfitclt.com/uploads/1/3/0/4/130478261/8926529.pdf
    • http://tiffanyleeofficial.com/uploads/1/3/0/7/130738836/3001129.pdf
    • http://823commerce.com/uploads/1/3/0/7/130740256/83f4d2eb30250.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d02.bin
d1650e901e0b840effbe8a056b6260be45b341ed551c652a463d011127fb1bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D02 8548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.