Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d9653b4a0771711…

MALICIOUS

PDF

43.7 KB Created: 2020-04-02 07:53:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 743e0ff51740f6d227deee86c3f992d9 SHA-1: 0e526d9de114133ee2e75588217c7b38fdeacb52 SHA-256: 4d9653b4a077171126ee5c74a0ac6954a6fd75797def6a98b1d088fb1b7e5b2c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to various PDF documents on different domains. This behavior is indicative of a link farm or SEO manipulation tactic, which is often used to distribute malicious content or to obscure the true origin of a threat. No scripts were extracted, and the document body text is largely unreadable, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://raisingtheblues.com/uploads/1/3/0/6/130603941/130603941.html#alcance+maximo+proyectil+9+mm
    • http://sjarmtrollbua.no/uploads/1/3/0/6/130639605/tukurolematotuvalo.pdf
    • http://endstone.org/uploads/1/3/0/4/130476887/wufopozesa-salazozegug-musevexitejuzod.pdf
    • http://mrglows.com/uploads/1/3/0/5/130550690/5862716.pdf
    • http://fixyourteethnow.com/uploads/1/3/0/3/130323298/3a02a75b.pdf
    • http://tihwwonline.com/uploads/1/3/0/2/130291712/zuxusepatekexu.pdf
    • http://elenas-artstudio.com/uploads/1/3/0/6/130604295/senuvexeniw-narad-zixokekil.pdf
    • http://jaciswritings.com/uploads/1/3/1/4/131453267/melozebu.pdf
    • http://aazraq.com/uploads/1/3/1/4/131409135/tugexisuge_ravuk_lozera.pdf
    • http://stephenho.org/uploads/1/3/0/4/130476684/b76f3360e6d991.pdf
    • http://thebriefcaseportfolio.online/uploads/1/3/1/0/131071256/kovatenufif_falom_wujokule.pdf
    • http://onehealthepigenomics.com/uploads/1/3/0/7/130775293/nabagizapitemuzus.pdf
    • http://placervideo.com/uploads/1/3/0/6/130604741/94200e6e45e.pdf
    • http://fordf25.info/uploads/1/3/0/8/130873994/sudixigofo.pdf
    • http://madrosecochran.com/uploads/1/3/0/2/130291416/kopatisi.pdf
    • http://kenrictaylor.net/uploads/1/3/0/7/130739294/705c347.pdf
    • http://18opportunities.com/uploads/1/3/0/6/130620931/nasuf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007f23.bin
d488e6a92682e94f3d5618875602a26f220a8ba70521a8015fb5dee89c43d839		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F23 9116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.