PDF malware analysis — malicious · 85ed711b6a71b006

MALICIOUS

PDF

44.7 KB Created: 2020-03-20 08:52:24 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 762ec8d46fa86ab54f29a3704bc24d22 SHA-1: 9978f51efae770c37d619bd76205d1f4789b1a0f SHA-256: 85ed711b6a71b006ae3b7d0699f7df7de237d301942bb4f592ff2752f8590b89

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a mass external link farm, with numerous URLs pointing to seemingly unrelated PDF files. The document body text, while containing a mathematical formula, also includes obfuscated content and references to wkhtmltopdf, suggesting it is not a legitimate document. The primary attack pattern observed is the use of a deceptive lure to drive traffic to a network of external sites, likely for SEO manipulation or to host further malicious content.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://cardsmovinginc.com/uploads/1/3/0/2/130271128/130271128.html#formula+para+calcular+la+area+del+circulo
- http://www.the-handy-services-market.com/uploads/1/3/0/6/130621214/fazenutawixu.pdf
- http://martinent.org/uploads/1/3/0/4/130489044/suparanemezon.pdf
- http://mfgm.de/uploads/1/3/0/6/130603931/wajojeberoliwe.pdf
- http://babygearrentalslu.com/uploads/1/3/0/2/130289229/bepekivikozopin.pdf
- http://kayakakaylee.com/uploads/1/3/0/5/130545333/ganina_fatav_dibuf.pdf
- http://msielectricalsupplies.com/uploads/1/3/0/6/130621905/7371430.pdf
- http://tanvirsidhu.com/uploads/1/3/0/4/130436415/laboxet.pdf
- http://remade.info/uploads/1/3/0/5/130538949/kudomimozumuwo.pdf
- http://bellastar.net/uploads/1/3/0/7/130775726/zajad.pdf
- http://sgdpress.com/uploads/1/3/0/7/130739347/9ba370f013e39.pdf
- http://visitcc.fun/uploads/1/3/0/2/130272377/4012207.pdf
- http://mytryshyn.com/uploads/1/3/0/7/130739387/395136.pdf
- http://webdisk.dicksonarchitecture.com/uploads/1/3/0/7/130739080/xuwosidu-kuzeg-xebupubirojizi.pdf
- http://sadini.net/uploads/1/3/0/5/130590163/rakokajagoritosusedi.pdf
- http://datprepcloud.com/uploads/1/3/0/7/130776695/zuzefafesa-pogelomojodas-vifusurola.pdf
- http://www.theviolinclub.co.nz/uploads/1/3/0/7/130738658/6e24202a00033.pdf
- http://www.friedrich-mack.com/uploads/1/3/0/3/130324065/2532392.pdf
- http://222.jillwilsonphotographyllc.com/uploads/1/3/0/6/130604283/notikexufusip_zapujasukibu_xopuvejezap.pdf
- http://technolearningrugo.com/uploads/1/3/0/9/130969971/94bc350e9fd18.pdf
- http://www.happybellyf2f.com/uploads/1/3/0/7/130775106/milariligebat.pdf
- http://dreamcatalyst.org/uploads/1/3/0/5/130540604/cefa206.pdf
- http://www.prakashayoga.com/uploads/1/3/0/5/130550736/zuvurefa_tevaligevovode_sojubitok.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000078b9.bin` `0d455d5028bab639fbe6e8d4fe179213faca9e344d9ea2257695b3f678df4000`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x78B9	8956 bytes
`font_01_sfnt_off00009929.bin` `985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9929	2788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.