Malicious PDF — malware analysis report

Static analysis result for SHA-256 880ec1f495b35945…

MALICIOUS

PDF

35.1 KB Created: 2020-03-31 01:13:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 40cc78e94561391a4b886e90e25aeff9 SHA-1: cd2b7e7037cb9b70742153b7424f39dc4857cf48 SHA-256: 880ec1f495b35945bb10fd6cbb59e75dae7d342a986dc645f6c3cc9e60a3d466
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on numerous domains, suggesting a link farm or a distribution mechanism for further malicious content. The document body contains garbled text and a reference to 'Fallout 76 slow download speed', which appears to be a lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://afaparents.org/uploads/1/3/0/5/130550777/130550777.html#fallout+76+slow+download+speed
    • http://reneegriggscaregiver.info/uploads/1/3/0/4/130436207/685989.pdf
    • http://tobymac.ca/uploads/1/3/0/5/130588191/xisupoj-tejuruk-pafobal-bamakoj.pdf
    • http://signtime.org/uploads/1/3/0/5/130547527/7e5130334fc93f8.pdf
    • http://mentalpraxis.net/uploads/1/3/1/1/131164246/4440985.pdf
    • http://klotz.xyz/uploads/1/3/0/5/130588796/xawijole.pdf
    • http://bigbsbarandgrill.com/uploads/1/3/0/2/130270955/61e706337.pdf
    • http://mymcpa.com/uploads/1/3/0/6/130605380/depamaxuguxo-tekopulaxe-widusaxiz.pdf
    • http://stickittolennon.com/uploads/1/3/0/7/130775222/fa13ae.pdf
    • http://sierranevadaretail.com/uploads/1/3/0/9/130968963/9091745.pdf
    • http://timelineofindia.com/uploads/1/3/0/6/130622101/1452140.pdf
    • http://ccluxurytravelgroup.com/uploads/1/3/0/3/130313108/jipalolererutelugez.pdf
    • http://eyekandy.shop/uploads/1/3/0/7/130738615/27bcc19ead386d.pdf
    • http://freehookupsforme.com/uploads/1/3/0/6/130604530/4810799.pdf
    • http://stilwellwise.com/uploads/1/3/0/6/130604411/gikaxe.pdf
    • http://weddingdjoxfordshire.com/uploads/1/3/0/5/130588606/kitomiwatozawe-saxifoxixiva.pdf
    • http://rozuki.net/uploads/1/3/0/5/130589228/faletawedegofa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061ea.bin
6d787c58c19c2cf6c40603d0c2986f9783709227dacbdaf367eb7042aab133a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61EA 7444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.