Malicious PDF — malware analysis report

Static analysis result for SHA-256 77d72e24edfe38df…

MALICIOUS

PDF

136.2 KB Created: 2020-05-27 11:20:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 764ce08bd32f5f7d6d73fbb0fdbaf479 SHA-1: fa7258b236440cc77803223b19be8499b0519e85 SHA-256: 77d72e24edfe38dfa70042f8aa2236de45401a54ca68eead13cb3cfef2e5bf2c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are structured as SEO-optimized links to PDF files. One of the embedded links, http://driftwoodshoresdesigns.com/uploads/1/3/0/7/130775503/130775503.html#chemistry+a+molecular+approach+4th+edition+pdf+download, suggests a lure for downloading a specific book. The presence of numerous similar links indicates a link farm or SEO spamming technique to drive traffic to potentially malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://driftwoodshoresdesigns.com/uploads/1/3/0/7/130775503/130775503.html#chemistry+a+molecular+approach+4th+edition+pdf+download
    • http://lascatolasonora.com/uploads/1/3/1/8/131857562/tujiwaxum-xibigo-lozikuvu-vuwuvejobu.pdf
    • http://crossborderproperty.com/uploads/1/3/1/3/131381919/5656787.pdf
    • http://businesssidekick.com/uploads/1/3/0/6/130620607/zawazewono.pdf
    • http://buberonline.com/uploads/1/3/0/6/130604054/3341261.pdf
    • http://runpts.com/uploads/1/3/0/5/130539428/sojikus_sivezefo_bazujapazebiwe.pdf
    • http://tresovelhas.com/uploads/1/3/0/3/130312950/9c6cdcf68a1e8.pdf
    • http://jerseygiantslice.com/uploads/1/3/0/7/130774965/2944923202b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001ca7f.bin
44b9cfd88623c16432b8c976ecc8804ea1b29f05eb936fe13da5063945751049		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1CA7F 2220 bytes
font_01_sfnt_off0001d422.bin
901cb7a3e24c0a518f480146fc38861482e6a3f7f61fdbb1a247c0612da4e6cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D422 12596 bytes
font_02_sfnt_off0001fe81.bin
bb43902997022403cc61b7cf9ea9d57e4ba2f3217dae227c226cb95de52f2dfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FE81 16256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.