Malicious PDF — malware analysis report

Static analysis result for SHA-256 5353d564c0e52ced…

MALICIOUS

PDF

39.1 KB Created: 2020-03-23 10:40:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5bba902d63172cec9a83c65ab0b9af72 SHA-1: 7c1259a954516c6fdb3d70eb0654d661bfb6e50b SHA-256: 5353d564c0e52ced12aba639362cddadc351af6d9be5953649208fb1efaba516
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are dynamically generated and point to unrelated domains, indicating a link farm or SEO scam. The document body, though partially corrupted, includes a URL that appears to be a lure related to "carbs in mini cupcakes". No scripts were extracted from this sample, and the primary malicious activity observed is the redirection to numerous external URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://performphysiotherapy.net/uploads/1/3/0/3/130323952/130323952.html#how+many+carbs+in+mini+cupcakes
    • http://albuquerquelacrossefiesta.com/uploads/1/3/0/7/130738639/518902edb81384.pdf
    • http://www.portdouglasequipmentandpartyhire.com.au/uploads/1/3/0/6/130604456/sugobujuwoje.pdf
    • http://coffsharbourroofing.com/uploads/1/3/0/5/130551310/jalejekof.pdf
    • http://hostmaster.bowenwellness.co.uk/uploads/1/3/0/6/130605044/a435a4.pdf
    • http://carriepwalton.com/uploads/1/3/0/3/130324011/tunevuza_xidigetu_jitenike_volilariziz.pdf
    • http://mygiantlapdog.com/uploads/1/3/0/7/130739021/696c1faacae2.pdf
    • http://ethelcalhoun.com/uploads/1/3/0/5/130589229/4481905.pdf
    • http://ruinedwritings.com/uploads/1/3/0/5/130541745/pamulejegukiwetegu.pdf
    • http://www.susanlawton.susan-zises.com/uploads/1/3/0/6/130620573/xagebilawivipixel.pdf
    • http://oxfordcountyhouseclearance.co.uk/uploads/1/3/0/6/130604482/f013f6f90.pdf
    • http://drtomfisher.com/uploads/1/3/0/4/130483902/kisetuzumak_waxikew_tutesevefa.pdf
    • http://puregreenjuice.com/uploads/1/3/0/6/130621182/dazajikitudogif.pdf
    • http://lankaspice.lk/uploads/1/3/0/7/130738741/7b4aa0b.pdf
    • http://discountvillage.ca/uploads/1/3/0/6/130639976/9573523.pdf
    • http://boydcountyautomotive.com/uploads/1/3/0/4/130483926/4379487.pdf
    • http://allamericandoorny.com/uploads/1/3/0/2/130288333/sinodonubizoredurun.pdf
    • http://hearttohomerealtyllc.com/uploads/1/3/0/5/130539637/3dbdd.pdf
    • http://submitresume.club/uploads/1/3/0/6/130620399/5050523.pdf
    • http://vincentoffroad.net/uploads/1/3/0/7/130775644/4485203.pdf
    • http://cruxpx.com/uploads/1/3/0/2/130288854/buxozil.pdf
    • http://www.christinewallphoto.com/uploads/1/3/0/7/130738676/jivowoge.pdf
    • http://propwiz.com/uploads/1/3/0/6/130620690/kozorixit.pdf
    • http://amarefinds.co/uploads/1/3/0/7/130740612/d0150ac8b515ac.pdf
    • http://www.samuelkaviar.com/uploads/1/3/0/4/130483508/9502649.pdf
    • http://thecarouselhouse.com/uploads/1/3/0/4/130483748/91a140f90caa9d.pdf
    • http://www.samuelkaviar.com/uploads/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000710e.bin
33d4b8b1c51450b01ada8c55d8510c93f5441b52daedc6c620493c372e866267		 pdf-font-stream PDF embedded font (sfnt) at offset 0x710E 7544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.