Malicious PDF — malware analysis report

Static analysis result for SHA-256 796d5a44c36609d9…

MALICIOUS

PDF

40.9 KB Created: 2020-03-23 13:12:32 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 68c6ab7a18e6c24d240017e2c97d6277 SHA-1: 8fa64e1475b69e5d0d5f09a6f696f637dc3b223f SHA-256: 796d5a44c36609d9bcbbd2e028083b8a673bf10ec4623556537493d7a12b88eb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes a reference to 'how to put two pictures side by side facebook', suggesting a lure. The primary attack pattern involves directing users to a vast collection of PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mccorkleagsales.com/uploads/1/3/0/5/130547515/130547515.html#how+to+put+two+pictures+side+by+side+facebook
    • http://sofopservices.com/uploads/1/3/0/6/130639539/4385221.pdf
    • http://rvservicesinc.com/uploads/1/3/0/5/130539756/7614607.pdf
    • http://canihaveacoupon.com/uploads/1/3/0/9/130969449/5438982.pdf
    • http://lurious.com/uploads/1/3/0/5/130589260/semopesedunusi.pdf
    • http://exceptionaleducators.org/uploads/1/3/0/6/130604750/fd4ed8e16bb9df3.pdf
    • http://mrdbmitchell.com/uploads/1/3/0/8/130813740/436f06a1.pdf
    • http://befois.com/uploads/1/3/0/6/130639533/7607439.pdf
    • http://germangholami.com/uploads/1/3/0/4/130476523/lalinizexavu-bilos-xuvejero-gapowavid.pdf
    • http://beachhousedestin.net/uploads/1/3/0/7/130776428/govazafofifovuxuj.pdf
    • http://usarooterplumbing.com/uploads/1/3/0/6/130621758/bivozu.pdf
    • http://robertsragdolls.com/uploads/1/3/0/4/130488500/5e531.pdf
    • http://kensingtonclockservice.com/uploads/1/3/0/6/130621496/worobisud-zesafowi.pdf
    • http://webdisk.polish-translation.org/uploads/1/3/0/7/130740298/b537faa87672e.pdf
    • http://www.nashairporthotel.ch/uploads/1/3/0/7/130738607/fovegubojati_kikozedatite.pdf
    • http://jordynoakland.com/uploads/1/3/0/6/130640090/dasitifefes_zivobutas_rogarajutifu_moxamedegaw.pdf
    • http://mydrivingschoolga.com/uploads/1/3/0/7/130776338/minufaxuwepuderer.pdf
    • http://mldesigns4u2.com/uploads/1/3/0/5/130588489/tiwelewogus-nugevi.pdf
    • http://literallynobody.co.uk/uploads/1/3/0/6/130604022/0fc6adb9d6eb6b9.pdf
    • http://njmedicalcannabis.com/uploads/1/3/0/6/130620279/2454600.pdf
    • http://marinaruss.net/uploads/1/3/0/5/130550985/kovewe_febum_kudul.pdf
    • http://portlandareainjury.com/uploads/1/3/0/5/130590438/rufaworip.pdf
    • http://professionalcallingagents.com/uploads/1/3/0/6/130605510/3d5fc5e7.pdf
    • http://audreleroux.com/uploads/1/3/0/8/130874474/zefebebowiwebuzifi.pdf
    • http://ahanna.org/uploads/1/3/0/7/130775427/rajimuw.pdf
    • http://mysignatureboutique.com/uploads/1/3/0/6/130621846/2d6ca4179ce8e87.pdf
    • http://audreleroux.com/uploads/1/3/0/8/130874474/zefebebowiwebuzi
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000763c.bin
cf949a046adc892d220694a9497d181ef82e7df72b96e25a15c4dabed9fd6e43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x763C 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.