Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ebacf84ba097744…

MALICIOUS

PDF

33.2 KB Created: 2020-03-14 02:58:04 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3af5582b0439fcb4355246430d4bef04 SHA-1: 12dd48dfdd49334c533dc861b49bc4e8d17d0415 SHA-256: 4ebacf84ba0977441bde7c9e95048d3fa222e62f921ba2cbcfd1a30cd5c48747
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to PDF files on various domains, suggesting a link farm or SEO spam tactic. One of the embedded URLs, 'http://mta-sts.mail.dickersongreenseminary.org/uploads/1/3/0/6/130621123/130621123.html#angle+pair+relationships+worksheet+kuta+software+answers', is presented as a worksheet, likely to deceive users into clicking. No scripts were extracted, and the document body is heavily obfuscated, limiting further analysis of intent beyond link distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mail.dickersongreenseminary.org/uploads/1/3/0/6/130621123/130621123.html#angle+pair+relationships+worksheet+kuta+software+answers
    • http://theinnonsilverlake.com/uploads/1/3/0/4/130476657/2d71c680224f.pdf
    • http://www.ravenlovefantasies.com/uploads/1/3/0/5/130545128/9424097.pdf
    • http://bvhstyle.com/uploads/1/3/0/5/130551197/rigopasinajesez_xarupagomunut.pdf
    • http://lafabriquedeclients.com/uploads/1/3/0/7/130776073/c08f4e7bf6eb2a3.pdf
    • http://perfilelearning.net/uploads/1/3/0/4/130476943/6043609.pdf
    • http://pitzy-web.com/uploads/1/3/0/7/130775961/7eb7f93.pdf
    • http://www.streaminglibrarians.com/uploads/1/3/0/6/130639084/3502974.pdf
    • http://theknittingroom.co.uk/uploads/1/3/0/4/130477135/2672385.pdf
    • http://www.alicezhouilc.com/uploads/1/3/0/8/130813650/1123523.pdf
    • http://everydayfreedom.co.uk/uploads/1/3/0/2/130274343/9163609.pdf
    • http://lavanderiaspadiniromacentro.com/uploads/1/3/0/5/130589267/kogopinopurof-jezeturazu-tanuruvujisejo-funeval.pdf
    • http://cherylreed.net/uploads/1/3/0/7/130775776/4419744.pdf
    • http://gamemasterj.com/uploads/1/3/0/6/130620949/1250904.pdf
    • http://mcdermottholdings.com/uploads/1/3/0/8/130874224/e60503e2.pdf
    • http://www.tonchairs.com/uploads/1/3/0/3/130379170/bofis.pdf
    • http://peshtolina.com/uploads/1/3/0/6/130621509/855ba.pdf
    • http://camtileandgroutcleaning.com/uploads/1/3/0/5/130590186/088dda1a.pdf
    • http://english.ckjmedia.no/uploads/1/3/1/1/131163760/bufolisugaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ae6.bin
5b6b3f0243ba12ef3d3cb9ef84e8debbcaa12532bc4936aa6e3b410dae8f97f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AE6 7140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.