Malicious PDF — malware analysis report

Static analysis result for SHA-256 48ff58c68583e7cb…

MALICIOUS

PDF

57.2 KB Created: 2020-06-07 15:50:21 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 747607f51a16d0736b744447b19bab04 SHA-1: 40d77c89d3de1deea112b1fa2ff109769ce0138e SHA-256: 48ff58c68583e7cb85657631113f7dbde727252a3dd57372f5e08dde07e00ed8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, including http://1hs.undesirable.us/ and http://fitsliceoflife.com/, suggesting a link farm or redirection scheme. The primary purpose appears to be directing users to potentially malicious content hosted on these external sites. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://1hs.undesirable.us/uploads/1/3/0/4/130488308/130488308.html#%25D8%25AD%25D9%2581%25D9%2584%25D8%25A7%25D8%25AA+%25D8%25AA%25D8%25A3%25D8%25AC%25D9%258A%25D8%25B1+%2528%25D8%25A8%25D9%2588%25D8%25B1%25D9%2586+%25D8%25AA%25D9%258A+%25D8%25A5%25D9%2583%25D8%25B3%2529
    • http://fitsliceoflife.com/uploads/1/3/0/3/130313729/supidataj.pdf
    • http://audreylouisedesigns.net/uploads/1/3/1/4/131453734/nevubedodibo.pdf
    • http://jllcapitalmarkets300southwacker.com/uploads/1/3/1/4/131406785/fukinuzusawi_nasifiruxajovu_rejev_kevaxenox.pdf
    • https://zafuwuma.files.wordpress.com/2020/06/61025096619.pdf
    • https://vavaxuxaber.files.wordpress.com/2020/06/53177111743.pdf
    • https://vibuxenex.files.wordpress.com/2020/06/vumufa.pdf
    • https://silujifof.files.wordpress.com/2020/06/66474523017.pdf
    • https://mekuwumatud.files.wordpress.com/2020/06/likof.pdf
    • https://gopapuwoko.files.wordpress.com/2020/06/lusilerejifafizam.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_003_off0000a20c.bin
da33aa315003f9dedb6e5b6bff11f577b4c5d6f1c7176b00a90a74442d41b43d		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA20C 30800 bytes
font_00_sfnt_off00008191.bin
01e2399567d05e95f7582934160a62b36d7a254cb5926c8d09806fca1d72a4d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8191 9448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.