Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a5c9c17c6ecf988…

MALICIOUS

PDF

50.6 KB Created: 2020-05-25 00:25:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5e95fe1248142c66f964b229abc77793 SHA-1: 8fe9079b85d7b31f17adafa6498f48952a84bd1e SHA-256: 4a5c9c17c6ecf988c2e53921689636b140116244ad330c9d40b46c5c0a053532
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, indicating a potential SEO spam or link farm operation. The document body contains text related to a 'booty challenge' and metadata from wkhtmltopdf, suggesting it was generated programmatically to host these links. No scripts were extracted, limiting the analysis of direct malicious actions.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://slugshotscomics.com/uploads/1/3/0/9/130969974/130969974.html#ashy+bines+28+day+booty+challenge
    • http://buildinggirls.com/uploads/1/3/0/6/130603994/vajomulenomur_memima_zogemitaxel.pdf
    • http://hostmaster.conrah.wales/uploads/1/3/0/7/130776611/vumox.pdf
    • http://meghavedika.com/uploads/1/3/1/8/131856100/nilikobobotaxilotap.pdf
    • http://rosieposiecookies.com/uploads/1/3/0/6/130603994/5717593.pdf
    • http://brittanysubambookshelf.com/uploads/1/3/0/6/130622061/mafejopejobe.pdf
    • http://lylaminxvip.com/uploads/1/3/1/3/131379384/6be6fa6b4421d01.pdf
    • http://twentypercents.net/uploads/1/3/1/6/131636983/fopibozib.pdf
    • http://webmail.websitesandsocialmedia.com/uploads/1/3/0/8/130874478/nisur.pdf
    • http://asistencia4x4.com/uploads/1/3/1/8/131856062/8759227.pdf
    • http://kingexpresssp.com/uploads/1/3/0/6/130620233/zafajug-tejivofiselo-tiras.pdf
    • http://healermen.com/uploads/1/3/0/6/130621709/wonixo.pdf
    • http://turningpointbaptistchurch.org/uploads/1/3/0/5/130550879/jegujebewas.pdf
    • http://kurekit.com/uploads/1/3/1/0/131071312/fofemusamopeji-poruwafexop-mulukuw.pdf
    • http://youthandlife.org/uploads/1/3/0/3/130313113/fipefuku.pdf
    • http://heartminneapolis.com/uploads/1/3/0/7/130739542/januwiti_nesawibiwojif_wozozajejigimu_jewubaloz.pdf
    • http://robiskincare.ca/uploads/1/3/0/8/130874157/wefor-zebalad-motokino-xokelelutojof.pdf
    • http://innovmarketing.com/uploads/1/3/0/5/130538841/wolusekusilakukok.pdf
    • http://voodooshacksauces.com/uploads/1/3/1/3/131378915/3830787.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006541.bin
08bb25870a890687b6215cb75cce28684feaefc70cf17e165c4fea0848c2cbc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6541 10684 bytes
font_01_sfnt_off00008382.bin
79112e6338abd39661eaf7979750ee44f96ee7ac068686929453c45ace365e22		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8382 11080 bytes
font_02_sfnt_off0000a921.bin
149cab45689013e99d1aa520d2e5234663aa5d8577b6aae5e423b5d60aeda4c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA921 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.