Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b61be7b6852c007…

MALICIOUS

PDF

41.9 KB Created: 2020-06-17 15:39:34 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 50797694c44616eb8c98a85bedcb7cca SHA-1: 2c0c9f1aa360b5ed3d5c9761838f25400b09e01a SHA-256: 7b61be7b6852c007a2a18d417843edf075ffb8f877598b35861b124409bcedb0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, many of which point to similarly structured URLs. The document body, though heavily obfuscated, contains text related to a tutorial and software, suggesting a lure to external content. The primary heuristic indicates a 'PDF_SEO_LINK_FARM', suggesting the document's purpose is to generate traffic to these external sites, likely for SEO manipulation or to host malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nextgensecuritysolution.com/uploads/1/3/2/6/132682607/132682607.html#tutorial+samplitude+music+studio+mx
    • http://hostmaster.unitak.no/uploads/1/3/0/7/130776589/pijivat_tijikodisafusez.pdf
    • http://autodiscover.smalltownfallbrook.com/uploads/1/3/1/4/131437092/2d3f9.pdf
    • http://2fu.undesirable.us/uploads/1/3/0/7/130775375/legogixufogiped_kinosizovabed.pdf
    • http://402south13th.com/uploads/1/3/0/8/130873895/f9e59334.pdf
    • http://mail.2wolvesinc.com/uploads/1/3/0/5/130539215/vovutiwarewes.pdf
    • http://salacia48t.com/uploads/1/3/0/4/130488888/lujupune-zofizufefek.pdf
    • http://fabricsoftheworld.net/uploads/1/3/2/3/132302876/jososifutetoba-kulunijudubarej-lusizubaj-tepoxej.pdf
    • http://allbatz.com/uploads/1/3/1/4/131437924/9595a3.pdf
    • http://hedc.yhedt.org.uk/uploads/1/3/0/8/130813077/diduvosomogi_mikubutox.pdf
    • http://hubertmccormack.net/uploads/1/3/0/9/130969963/9244736.pdf
    • http://hedc.yhedt.org.uk/uploads/1/3/0/8/130813077/diduvosomogi_mikubuto
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062b1.bin
8cbeac14251392082917ffd96633c5bae1af3ddc5009aa527fe9e63807accdf5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62B1 5012 bytes
font_01_sfnt_off000073bd.bin
0e5b16f7b440b5dab608bcf00eebe39bca7b2b72b3e9b4320455f83a88fc9cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73BD 11920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.