Malicious PDF — malware analysis report

Static analysis result for SHA-256 856e02268f5e859f…

MALICIOUS

PDF

37.9 KB Created: 2020-03-28 05:05:19 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 71ba161e1825572e8153f05b78079c2e SHA-1: 28b805191be34e9b88bae7ba2a2a02efb387287c SHA-256: 856e02268f5e859f80d58b803a62877be890da36f5dff646df4aaf4b458682a7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files on different domains. This behavior is indicative of a link farm or SEO spamming technique, potentially used to distribute malicious content or manipulate search engine rankings. The document body contains text related to a 'Troy bilt 2700 psi pressure washer pump diagram', which appears to be a lure to attract clicks to the embedded links. No scripts were extracted, and the primary malicious activity observed is the mass distribution of external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://batonrougeplumbinganddrain.com/uploads/1/3/0/8/130814471/130814471.html#troy+bilt+2700+psi+pressure+washer+pump+diagram
    • http://onyxarcata.com/uploads/1/3/0/4/130476976/roguwiluv-wilabuvet-medakogivuzag.pdf
    • http://ricebeansandh2o.com/uploads/1/3/0/3/130312971/gipideloboru_zenijejajew_nupupi_zarir.pdf
    • http://achintconsultinginc.com/uploads/1/3/0/3/130323103/6511362.pdf
    • http://econrefresh.co.uk/uploads/1/3/0/2/130288421/1103998.pdf
    • http://tcncleanservice.com/uploads/1/3/0/6/130640059/nizatevotakurokizi.pdf
    • http://bonvivantsdc.com/uploads/1/3/0/5/130543020/9df5df2704b4e.pdf
    • http://johnnyraygibbsactor.com/uploads/1/3/0/7/130776458/jubava.pdf
    • http://bluesprucebeeco.com/uploads/1/3/0/9/130969405/rajofofusor.pdf
    • http://christinahankinsart.com/uploads/1/3/0/8/130873890/wuwikopobidivepo.pdf
    • http://www.k-marieconsultant.com/uploads/1/3/0/4/130476006/97488c93d621fd.pdf
    • http://mta-sts.mail.columbiapage.com/uploads/1/3/0/6/130620804/b7f3e06.pdf
    • http://chicagonightlifepass.com/uploads/1/3/0/4/130483416/1872860.pdf
    • http://appraisejewelry.net/uploads/1/3/0/7/130776291/kaxanu-wupomuwapeg-jibutojafidip-kevituzofe.pdf
    • http://mail.e-s-network.com/uploads/1/3/0/2/130287957/7979609.pdf
    • http://www.alkalinetwat.com/uploads/1/3/0/7/130740053/jitexefasuju.pdf
    • http://www.bestinthewestmovers.com/uploads/1/3/0/7/130775232/423512.pdf
    • http://ianwalkerlaw.com/uploads/1/3/0/5/130543761/c88c99546.pdf
    • http://reconmetal.ca/uploads/1/3/0/7/130739498/9c874761ca.pdf
    • http://eloraadventurecamp.com/uploads/1/3/0/5/130589276/6636050314e06.pdf
    • http://ravens-creations.com/uploads/1/3/0/7/130738943/wepavetosilin-fesegisivabufum-penidopavav-zolevavi.pdf
    • http://myladykarma.com/uploads/1/3/0/5/130538836/cdeb619.pdf
    • http://warriorspath4veterans.org/uploads/1/3/0/5/130541552/0d51a6464c95.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069c7.bin
447f90846e06f7aefc64735364fb0a9df736a0b25e0cbed019b9da76e9498d04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69C7 8312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.