Malicious PDF — malware analysis report

Static analysis result for SHA-256 49afddcf778e74d5…

MALICIOUS

PDF

50.9 KB Created: 2020-03-28 09:26:03 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 74781b1ebefd89df61e93e1f7fefaa7c SHA-1: 0779cb16fe82705c309f5847df34464ed538eb78 SHA-256: 49afddcf778e74d55f54e5fd92948d2c96e7bd2b43426f33c8fbd2a6c1f878df
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text related to a 'Canon eos rebel xs manual pdf' and references the wkhtmltopdf tool, suggesting a lure to download a manual. The primary function appears to be directing users to a large number of other PDF files hosted on various domains, likely for SEO spam or to host malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chichesterfootandankle.org/uploads/1/3/0/6/130640235/130640235.html#canon+eos+rebel+xs+manual+pdf
    • http://www.juliehimes.com/uploads/1/3/0/4/130483953/5195071.pdf
    • http://www.kekuna.org/uploads/1/3/0/6/130639539/piwubos.pdf
    • http://orquestacastillayleon.net/uploads/1/3/0/2/130272945/jelesokoza_bejeveloxi_forifuxofun.pdf
    • http://saladextraveganza.com/uploads/1/3/0/6/130621439/c4e8c2bd0ba2548.pdf
    • http://jjenewein.com/uploads/1/3/0/6/130604061/5614734.pdf
    • http://baxtercollective.com/uploads/1/3/0/7/130776386/c1f3cf59ff960d.pdf
    • http://caitescapestravel.org/uploads/1/3/0/5/130539437/bewefexaju.pdf
    • http://nancyzhang0313.com/uploads/1/3/0/6/130604844/lefuz.pdf
    • http://claritypsych.com/uploads/1/3/0/3/130379492/8831356.pdf
    • http://dipagnu.com.br/uploads/1/3/0/8/130814633/9554235.pdf
    • http://sfelegantbath.com/uploads/1/3/0/6/130604061/5564409.pdf
    • http://webdisk.kilookas.com/uploads/1/3/0/6/130604923/gunidos.pdf
    • http://www.knowher.com.au/uploads/1/3/0/7/130740375/saledopog_sanogilewowafuw.pdf
    • http://lariesalon.com/uploads/1/3/1/0/131071111/xetiledi_vabumu.pdf
    • http://banchoryeastchurch.org/uploads/1/3/0/3/130323227/jumirux.pdf
    • http://www.namastae.ca/uploads/1/3/0/5/130588380/ef6d899d4f71.pdf
    • http://destinycenter.info/uploads/1/3/0/5/130551103/lapexemode.pdf
    • http://aelberspersoneel.net/uploads/1/3/0/7/130740510/gaxevetogeguf.pdf
    • http://mixedattainmentteaching.com/uploads/1/3/0/7/130775354/difisajiw.pdf
    • http://movingmountains.services/uploads/1/3/0/6/130621281/3fdace6f07c7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009b64.bin
c419d271e26cfc0f808fd47394be8bc972977cd3c67a9dd4de214d4c203d53a0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B64 9400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.