Malicious PDF — malware analysis report

Static analysis result for SHA-256 51310b1e69b7be03…

MALICIOUS

PDF

42.5 KB Created: 2020-03-26 07:16:55 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 622019254adb12b5f4fcd10741e60de2 SHA-1: d954a4b9ba31467a0d1d04223a311a8e00b44579 SHA-256: 51310b1e69b7be036170ead2e2d4127ceb1a01318ceeeabf5c8deefe8b33a5cc
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, a technique often used for SEO spam or to redirect users to malicious sites. The document body itself contains a seemingly unrelated title and authoring application information, suggesting it's a wrapper for the links. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://byrdtransportplus.net/uploads/1/3/0/5/130540009/130540009.html#youtube+biografia+de+cuco+sanchez+nuestro+gran+amor
    • http://dossys.com/uploads/1/3/0/5/130540592/dfd8a6e109fac5.pdf
    • http://digestivetracker.com/uploads/1/3/0/8/130814065/643eb2268.pdf
    • http://ranjwrites.com/uploads/1/3/1/0/131070501/31768b.pdf
    • http://bogadancers.com/uploads/1/3/0/7/130739830/432484.pdf
    • http://www.onecreativechick.com/uploads/1/3/0/7/130775758/bezefamuxuteni.pdf
    • http://osheastuff.com/uploads/1/3/0/7/130775734/rewulolopazaxez.pdf
    • http://annaboland.com/uploads/1/3/0/3/130313495/8575253.pdf
    • http://www.karamarie.org/uploads/1/3/0/3/130313491/9df4dc769f032e.pdf
    • http://bearsversusbabiesgame.com/uploads/1/3/0/6/130604741/tevezisa_ralatizajum_nodujakil_buwatotozi.pdf
    • http://onefootinfront.com/uploads/1/3/0/7/130739373/ripemolefem-koruza-dagozi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000675d.bin
d574a4394541000cc92b6c1586e7fdba52a35bdec8f3e99a29cbb53c37135d58		 pdf-font-stream PDF embedded font (sfnt) at offset 0x675D 8988 bytes
font_01_sfnt_off0000880c.bin
b3affdfdfee497c2d3230853582529cf395d265bfdbb8cde7d84ae9c33602211		 pdf-font-stream PDF embedded font (sfnt) at offset 0x880C 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.