Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e4f77782ec0bbf4…

MALICIOUS

PDF

44.8 KB Created: 2020-03-21 15:16:51 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8e4dca3e57cd519bbd6b8d38e9ac178c SHA-1: 357af42df2e9bf526c8f49f945d4633864decd27 SHA-256: 7e4f77782ec0bbf4bb26f9c82450123a72686e74839bf7281287cd9b61a93c74
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary URL points to a page with the title 'Juegos de percepcion visual para imprimir', suggesting a lure for users seeking printable visual perception games. The document's structure and the sheer volume of outbound links indicate a likely SEO spam or link farm tactic, potentially used to distribute malware or drive traffic to malicious sites. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fashionbx.com/uploads/1/3/0/6/130604799/130604799.html#juegos+de+percepcion+visual+para+imprimir
    • http://throughchristfit.com/uploads/1/3/0/5/130551299/lemumoma_vivezu.pdf
    • http://toledoandpartners.com/uploads/1/3/0/9/130969221/kiziwun.pdf
    • http://nubbinridgefarms.com/uploads/1/3/0/8/130874683/9364653.pdf
    • http://walkersshuttlexpress.com/uploads/1/3/0/6/130639267/1469a01.pdf
    • http://www.elitebaseballbootcamp.com/uploads/1/3/0/6/130639931/7168738.pdf
    • http://www.lostandliving.com/uploads/1/3/0/6/130621293/mebokewok.pdf
    • http://sweetliving.net/uploads/1/3/0/6/130620833/gonokukukakef.pdf
    • http://bentleyspaintingandpressurewashing.com/uploads/1/3/0/6/130639386/tiwuvamuwiv-revufopozo.pdf
    • http://livingtheedge.org/uploads/1/3/0/2/130272587/virujesivawavojagi.pdf
    • http://thegreatrising.com/uploads/1/3/0/2/130289466/valigavuk_bugul.pdf
    • http://anglemidwest.com/uploads/1/3/0/2/130271015/sozinex_wiregigetig.pdf
    • http://manawell.net/uploads/1/3/0/2/130270804/lojoniti.pdf
    • http://www.kathleensmithbelcher.com/uploads/1/3/0/8/130813111/manibezu.pdf
    • http://www.amhalford.com/uploads/1/3/0/6/130621345/541518ec88f14a.pdf
    • http://newyorklaserdentist.services/uploads/1/3/0/6/130604153/pagabumevoguboked.pdf
    • http://audiorewind.com/uploads/1/3/0/5/130551229/6621389.pdf
    • http://garyfowliemedia.com/uploads/1/3/0/3/130313588/456268.pdf
    • http://relxthai.com/uploads/1/3/0/5/130589159/a3f86eb10.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e5a.bin
95b070afd41dff3f2eb3b7a033e5b54613e9a99466ee3f2d4fd6597d063008ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E5A 9096 bytes
font_01_sfnt_off00008ee9.bin
d15bee2c8b97ad99451c7d0e5f2dde1b71447a586908bd901620b957bd88f686		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EE9 16076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.