Malicious PDF — malware analysis report

Static analysis result for SHA-256 49aa152ea8a89d86…

MALICIOUS

PDF

46.0 KB Created: 2020-06-06 22:45:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4bd96bbe7850786f36e5ad14d919a19e SHA-1: 83061bbb1cff6731f6b0e6db16fe02ac42311227 SHA-256: 49aa152ea8a89d86dfb989aca34a74c3e9ef6b4f9cde11fcd334673aaa068584
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm of 28 SEO-optimized PDF files, designed to lure users into downloading potentially malicious content. The primary lure appears to be related to 'periodization in muscle building' or similar fitness topics, with the document body containing a truncated version of this lure. The embedded URLs point to various domains, suggesting a broad distribution effort. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://juliacoulter.com/uploads/1/3/0/8/130874254/130874254.html#periodiza%25C3%25A7%25C3%25A3o+na+muscula%25C3%25A7%25C3%25A3o+livro+download
    • http://mathsme.com/uploads/1/3/1/3/131383207/27635778.pdf
    • http://northgapoolliners.com/uploads/1/3/0/6/130620624/84056.pdf
    • http://amijamestextileart.com/uploads/1/3/1/3/131398334/991bcd65229563c.pdf
    • http://gamebeasts.co.uk/uploads/1/3/0/5/130539437/124614.pdf
    • http://boorskale.com/uploads/1/3/0/8/130873822/6821349.pdf
    • http://sberprize.space/uploads/1/3/1/4/131406837/5166963.pdf
    • http://frenchiepuppies.love/uploads/1/3/1/3/131380814/4842965.pdf
    • http://raw-eventing.com/uploads/1/3/1/4/131455072/eba5ead853a0.pdf
    • https://keligorages.files.wordpress.com/2020/06/41602983178.pdf
    • https://xulugotar.files.wordpress.com/2020/06/83231738178.pdf
    • https://megujujuget.files.wordpress.com/2020/06/mekopixipuruzogozogu.pdf
    • https://xidedikef.files.wordpress.com/2020/06/42053681167.pdf
    • https://zabalojiji.files.wordpress.com/2020/06/79706016597.pdf
    • https://nelagudisuz.files.wordpress.com/2020/06/lomepitaz.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007fed.bin
76818dec884e80c6b92426a0721ec7e8daede2b4dbd9ce36ef9b20fdc55d6de5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FED 15348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.