Malicious PDF — malware analysis report

Static analysis result for SHA-256 5846b6e3e6fcd491…

MALICIOUS

PDF

42.4 KB Created: 2020-03-21 19:49:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 55c04ee186f576ce844db7c1c23d0e11 SHA-1: 1692a37124ca5a5e337512f79c7f08c5d5fbbc59 SHA-256: 5846b6e3e6fcd491e66a0384135574f70a63b0f6100b1a79c0c5be6b3395ce6a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1598 Gather Victim Identity Information T1204 User Execution

The PDF file contains a large number of external links, many of which point to other PDF files with numeric or generic slugs. This pattern is indicative of a link farm or SEO manipulation tactic. The document body contains a lure related to a song download, which is likely a pretext to disguise the malicious intent of generating traffic to these external links. No scripts were extracted, limiting the ability to determine further malicious actions.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://peakathleticsystems.com/uploads/1/3/0/5/130588487/130588487.html#mafikizolo+baby+i+been+thinking+about+you+free+mp3+download
    • http://iris-xr.com/uploads/1/3/0/3/130323723/vakuwoxe.pdf
    • http://valcom.tv/uploads/1/3/0/7/130776418/faxuladejiju_tebekopeb.pdf
    • http://jujz.net/uploads/1/3/0/4/130483047/8330907.pdf
    • http://mail.iheartgameart.com/uploads/1/3/0/6/130640033/rinubabami.pdf
    • http://a1mann.com/uploads/1/3/1/1/131163718/xixumetekak.pdf
    • http://mvmaxclinicadeginastica.com/uploads/1/3/0/3/130379347/naboxi-kijok-gukozoref.pdf
    • http://beeawareaustralia.org/uploads/1/3/0/4/130483864/f005756eb71.pdf
    • http://www.cbdonlywa.com/uploads/1/3/0/5/130590219/c8599bc5375127.pdf
    • http://moongategardenyoga.com/uploads/1/3/0/4/130435780/tusozonixefuba-ralusug-juzosaxemug.pdf
    • http://spilledbeanscoffee.com/uploads/1/3/0/6/130639780/8822584.pdf
    • http://zaaduu.net/uploads/1/3/0/4/130475982/vorufas.pdf
    • http://118erotica.com/uploads/1/3/0/7/130738623/1885238.pdf
    • http://breasthealthconsulting.com/uploads/1/3/0/6/130620367/gilumupuzipazi.pdf
    • http://sallysfitnessfortress.com/uploads/1/3/0/5/130539139/2188285.pdf
    • http://www.mail.polishedsculpture.com/uploads/1/3/0/5/130544147/gegupafaripebov-pizot-sozatolorowuja.pdf
    • http://action-appliance-installation.net/uploads/1/3/0/5/130547576/5919047.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000738c.bin
370b8071432fb495d03dc9a78e59abe95f5c65d722b593199286350c9e60c84d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x738C 7804 bytes
font_01_sfnt_off00009211.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9211 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.