Malicious PDF — malware analysis report

Static analysis result for SHA-256 821184daa0d0c476…

MALICIOUS

PDF

44.9 KB Created: 2020-03-25 09:33:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4fe54980ab70769fdf16da75598be738 SHA-1: f1a4dd2521550b00978b22a831f0d87443f86d93 SHA-256: 821184daa0d0c47667bf99c5e2a9f96e272a22cf2e786352105d8559ae8d43e9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body contains text related to 'Esl teacher job description resume', which appears to be a lure. The primary attack pattern involves directing users to a vast collection of other PDF documents hosted on various domains, likely for SEO spam or to distribute further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://popjetfountain.com/uploads/1/3/0/6/130620691/130620691.html#esl+teacher+job+description+resume
    • http://terriholifield.com/uploads/1/3/0/5/130588718/vududegexidinikiw.pdf
    • http://icmoreyardsailingonline.com/uploads/1/3/0/6/130621589/mamomiresojir.pdf
    • http://brandonhartshorn.com/uploads/1/3/0/6/130640063/konovojotazafo_madutu.pdf
    • http://www.qodelive.com/uploads/1/3/0/6/130605222/mesuxibitower-davex.pdf
    • http://infusion-consulting.com/uploads/1/3/0/6/130621988/keronaxane-wudabadalu-pejibitepaz-jubizigibolelu.pdf
    • http://luxxweddingsevents.com/uploads/1/3/0/2/130274291/ludixojo.pdf
    • http://mdprintmaker.com/uploads/1/3/0/6/130603985/1659b.pdf
    • http://www.motorkledingstyling.nl/uploads/1/3/0/8/130874233/vusorusegami_wigunon_zofadadotad_kobakugikabiro.pdf
    • http://tiarealestatesolutions.com/uploads/1/3/0/6/130621698/9458082.pdf
    • http://sirsandboys.com/uploads/1/3/0/2/130289662/kijejolofuwozo.pdf
    • http://mta-sts.mail.encounterweightloss.com/uploads/1/3/0/6/130604508/2948031.pdf
    • http://melindrosa.com/uploads/1/3/0/5/130550748/fezosopivure.pdf
    • http://drtoxy.com/uploads/1/3/0/7/130739463/puxadofetaxoji.pdf
    • http://mytaj-prembenefits.com/uploads/1/3/0/2/130288549/50fd3ee2771c.pdf
    • http://www.undisclosedtactical.com/uploads/1/3/0/2/130273982/kipud-riwuwatexuga-kewigalibow-kutemuwozat.pdf
    • http://tuxrentalinnh.com/uploads/1/3/0/6/130604358/fedetonevebi-ditapili.pdf
    • http://nothincookiecutter.com/uploads/1/3/0/6/130603822/bofetor.pdf
    • http://freespiritslongisland.com/uploads/1/3/0/6/130639123/6602661.pdf
    • http://brettdickdpt.com/uploads/1/3/0/6/130639439/vomigajem_satunuvam.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008655.bin
ceaadb1f9e8a3eca3d1484b7cf2bb855fedc8689116b201b49ec11b95f867382		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8655 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.