Malicious PDF — malware analysis report

Static analysis result for SHA-256 85ac6a023854dbac…

MALICIOUS

PDF

36.2 KB Created: 2020-04-28 05:05:32 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 719c5229d9ddad34bebf9e59ad75c6ab SHA-1: 21554b51a39882849bee98600d5bd16abc29fc83 SHA-256: 85ac6a023854dbacb45f5e52ed334c869e42ff7a3ededacdc2dc6e6f9bb7ecf4
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes phrases like 'Thriller pdf books online' and references to 'wkhtmltopdf', suggesting a lure to potentially malicious or SEO-abusive content. The embedded URLs are likely part of a link farm or redirect chain.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theovercomersblueprint.com/uploads/1/3/0/7/130740489/130740489.html#thriller+pdf+books+online
    • http://agentemily.com/uploads/1/3/1/6/131606523/6731400f7.pdf
    • http://lehighvalleyweddingchapel.com/uploads/1/3/0/5/130590353/kalepuwapa_wijajir.pdf
    • http://otisreddingrestaurant.com/uploads/1/3/0/2/130272296/1308190.pdf
    • http://brighteyesoliver.com/uploads/1/3/0/9/130969430/823fe6836b465ab.pdf
    • http://intellisys.biz/uploads/1/3/0/3/130324005/razowixuse.pdf
    • http://shades03cha.com/uploads/1/3/0/4/130476624/nugeworevu-xewofexelada-gubojewulitoro-bowajowunufot.pdf
    • http://buswell.ca/uploads/1/3/0/6/130639115/5040c.pdf
    • http://redstreet-legalgolf.com/uploads/1/3/0/4/130489423/bd1a9dda9440.pdf
    • http://freespiritslongisland.com/uploads/1/3/0/5/130551423/2816268.pdf
    • http://mvptransfergreece.com/uploads/1/3/1/3/131379312/4db7650dcafe.pdf
    • http://juansosairrigation.net/uploads/1/3/1/4/131452893/150221.pdf
    • http://lizzyandmike.com/uploads/1/3/0/7/130740033/1135034.pdf
    • http://shopkaykaysplace.com/uploads/1/3/0/6/130621412/2348952.pdf
    • http://technologybranch.com/uploads/1/3/0/6/130621290/9a063.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000064fb.bin
96e0bfb3b2f786276c0760cb3e75f0e6ef313c7e00ff33cc71d2924957a54960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64FB 8428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.