Malicious PDF — malware analysis report

Static analysis result for SHA-256 8771f76fbe84ad74…

MALICIOUS

PDF

46.6 KB Created: 2020-04-09 13:27:19 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6251f8576378e2f28ac835bad01eb534 SHA-1: 335b3e4fcc2d94bc842d584610596d4dacdb933f SHA-256: 8771f76fbe84ad74066ffe8ff2bfd13248b78a37df70c5e29cefad02a8db2f1a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links are likely part of a link farm designed to deceive users into clicking them, potentially leading to malicious websites or further downloads. The document body itself contains text that appears to be a lure for reading online content, further supporting the social engineering aspect of this attack.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://opssecurityagency.com/uploads/1/3/1/4/131437370/131437370.html#wide+sargasso+sea+read+online+free
    • http://trumpopoly.com/uploads/1/3/0/5/130542736/8521085.pdf
    • http://secondpunicwar.com/uploads/1/3/0/6/130639922/zunazo-megiv-zukagipudov.pdf
    • http://uapcdallastexas.org/uploads/1/3/1/1/131163535/zokob_vozuzeb_kegilaxi.pdf
    • http://henrycosaddleclub.com/uploads/1/3/0/6/130639958/ac6f9.pdf
    • http://temeculavalleyfluteacademy.com/uploads/1/3/0/5/130589416/744cb9578.pdf
    • http://felicewinograd.com/uploads/1/3/0/7/130776328/2308261.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077cb.bin
9d191bf83a1396b6f42b1700dff49cf039e56673d51b8bfe07dc6884310576a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77CB 8544 bytes
font_01_sfnt_off00009833.bin
ecf8d7eb8979946651044dfbc1257892f71f52449f1f75a191dacfeafa9f3b20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9833 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.