Malicious PDF — malware analysis report

Static analysis result for SHA-256 56e6b9ede05e3e1c…

MALICIOUS

PDF

46.3 KB Created: 2020-03-25 13:52:30 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 418b26828e24bf2ba3f64517905dfac4 SHA-1: aac52cb339d9631211ca5adebe46a197b6399421 SHA-256: 56e6b9ede05e3e1cc365617e6740972604dd04f6146c530a083f33376a2278d4
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, a technique commonly used to create link farms for SEO manipulation or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, pointing to a network of sites hosted on domains like 'store.arvadahistory.org' and 'korissakipping.com'. No scripts were extracted, but the sheer volume of links suggests a delivery mechanism for further malicious activity.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://korissakipping.com/uploads/1/3/0/6/130605314/130605314.html#calcular+hipotenusa+con+angulo+y+cateto+adyacente
    • http://store.arvadahistory.org/uploads/1/3/0/3/130323601/davalafepi_gopujapiv_jabidimaz_vegetifiseti.pdf
    • http://uceme.com/uploads/1/3/0/9/130969053/tobepesepekigizo.pdf
    • http://mathslord.com/uploads/1/3/0/6/130621870/pagufetotuvil_gemovugiwem_fisonejas_zesakawelog.pdf
    • http://ansgarmueller.com/uploads/1/3/0/7/130776101/2391128.pdf
    • http://obituarydating.net/uploads/1/3/0/6/130639257/kavatusuvabi.pdf
    • http://amanda-mccall.com/uploads/1/3/0/6/130605240/gapedef.pdf
    • http://trundletray.com.au/uploads/1/3/0/4/130436242/9985761.pdf
    • http://lauradonnellylifestyle.com/uploads/1/3/1/1/131163660/gexisotunakuxed.pdf
    • http://nikkiheyder.com/uploads/1/3/0/4/130476917/9110045.pdf
    • http://www.katiekeenan.net/uploads/1/3/0/4/130488631/d80acf.pdf
    • http://elementslifecoaching.com/uploads/1/3/0/7/130775087/xidinegejojopeka.pdf
    • http://traversebaypainting.com/uploads/1/3/0/8/130874676/juwoxur_reratibijutida_badugibekofop_mivefivejawuko.pdf
    • http://omeduconsulting.com/uploads/1/3/0/4/130483191/gekekuzawudixazilaw.pdf
    • http://alabamagamewarden.com/uploads/1/3/0/5/130588410/eb9ef524e68943.pdf
    • http://atlasspaceandplace.com/uploads/1/3/0/7/130739258/e390ced7f94.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d9a.bin
66695ea6312316a20e60cd6dace730b384a8bc04ac113857c68151c8f3113268		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D9A 9888 bytes
font_01_sfnt_off00009132.bin
885781ec91db75dc8c4a6a3d3dac0324bdfdb8f2239dab70466c62035ae072da		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9132 4144 bytes
font_02_sfnt_off00009e2b.bin
23ed613d66e62d7492f083dd3d1aa2d2971aeb1fa9ed000d0284fe7502844c4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E2B 3064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.