Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c9f552d0ba8026b…

MALICIOUS

PDF

34.3 KB Created: 2020-04-09 14:16:15 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 77df32a8d7a382f023247164c029ebbb SHA-1: 2c9eff350ececbeffabc175b659a86b4a471922c SHA-256: 4c9f552d0ba8026b850b457feb4c5c3d713e530e847d95f1e85369fe46233657
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous embedded URLs, many of which are part of a link farm designed to appear as legitimate content. The document body, though heavily obfuscated, contains references to 'Sentry safe user guide' and the wkhtmltopdf generator, suggesting a lure to disguise malicious links. The primary heuristic identified a link farm structure, indicating a likely attempt to redirect users to potentially malicious content hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vegmancontrol.com/uploads/1/3/1/4/131406456/131406456.html#sentry+safe+user+guide
    • http://gonskylaw.com/uploads/1/3/1/1/131164257/mizewuramivifuw-renikol.pdf
    • http://aremco.net/uploads/1/3/0/6/130604561/xusozekikam_zogenodi_tegafomu.pdf
    • http://topnotchhomeimprovement.net/uploads/1/3/0/7/130739619/sasugota.pdf
    • http://jigmey.com/uploads/1/3/0/3/130312925/walofapod.pdf
    • http://lbcvilseck.com/uploads/1/3/1/4/131453592/xemusasavobomarufa.pdf
    • http://glassonglassart.com/uploads/1/3/0/4/130435729/4891341.pdf
    • http://bradlademann.com/uploads/1/3/0/2/130289222/b7997c691669.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c3b.bin
d19916fbe73476e46fd0b95906c0e7eac03cf8ffe2f64b149041b60556268ff1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C3B 9784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.