Malicious PDF — malware analysis report

Static analysis result for SHA-256 78f2406b24d130c3…

MALICIOUS

PDF

39.3 KB Created: 2020-03-23 12:22:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 895e35bc776b63e83566d5771dd9fa75 SHA-1: cde2cbf83cb1c92efba58ca99deb2229416f77da SHA-256: 78f2406b24d130c3aad5b44f510aa7e4e3c88b454dcdc38614baefeb3dad26fa
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes a URL that matches one of the extracted links. The primary purpose appears to be directing users to a vast collection of other PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michaelwellsart.com/uploads/1/3/0/4/130436337/130436337.html#unit+2+solving+equations+and+inequalities+worksheet+answers
    • http://hostmaster.therecoveryfestival.co.uk/uploads/1/3/0/3/130323207/gusubogewosojug.pdf
    • http://goodbyetorenting.com/uploads/1/3/0/3/130379297/c3e379.pdf
    • http://braizinmuebles.com/uploads/1/3/0/8/130874526/rajajiwujame.pdf
    • http://nietojewelry.com/uploads/1/3/0/5/130588799/vavapumupajebu_kulib.pdf
    • http://hostmaster.jeroenvandijken.eu/uploads/1/3/0/2/130289256/cd5db65e7cd.pdf
    • http://bunburymarriage.com/uploads/1/3/0/5/130588463/2721549.pdf
    • http://kunzeartgallery.com/uploads/1/3/0/3/130379138/sagavofipux.pdf
    • http://www.dadevilledixieyouth.com/uploads/1/3/0/6/130604388/tidoweziwiwojajiluji.pdf
    • http://courtneysteed.com/uploads/1/3/0/6/130605490/3715523.pdf
    • http://sheimdal.com/uploads/1/3/0/8/130813079/pusulobix.pdf
    • http://littledragonsrugby.org/uploads/1/3/0/5/130550827/5690d624c.pdf
    • http://globalpart.info/uploads/1/3/0/7/130740572/xafewot.pdf
    • http://golfscoutapp.com/uploads/1/3/0/6/130604729/nanizetebolufot_pevoketeben_puxenolo.pdf
    • http://mercedjet.com/uploads/1/3/0/7/130740480/koveminarok.pdf
    • http://m.namiracine.org/uploads/1/3/0/7/130740210/padipirima.pdf
    • http://traicay123.com/uploads/1/3/1/1/131163864/menitabipekilul-dutagav.pdf
    • http://soloinsurancequotes.com/uploads/1/3/0/9/130969879/1d0ac37f69fb.pdf
    • http://thefiprofessor.com/uploads/1/3/0/5/130551339/4345795.pdf
    • http://tomwenfashiondesign.com/uploads/1/3/0/5/130590361/4ac7c8.pdf
    • http://teatrforte.pl/uploads/1/3/0/2/130288363/2996909.pdf
    • http://carroattrezziusati.com/uploads/1/3/0/6/130621451/732375a30c6d56.pdf
    • http://firstaid4life.net/uploads/1/3/0/5/130542972/4400520.pdf
    • http://www.anywound.com/uploads/1/3/0/6/130603725/5530947.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006edf.bin
d00f536adb082af8b3330d1f53c3418a0de9aa1101b42743629ef7a21996e54c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EDF 7800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.