Malicious PDF — malware analysis report

Static analysis result for SHA-256 8988c7f3e5cc9aa8…

MALICIOUS

PDF

38.6 KB Created: 2020-06-17 00:09:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 65d62d0b02279d2aa0006161ce35cb30 SHA-1: 1695c6c6f312a8d23b0b23a4618a15014d07f398 SHA-256: 8988c7f3e5cc9aa88dc2ffdf88509a3afa3fe1b5ebd3dd897f60ddf8d520de85
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure related to "Porsche katalog pdf" and exhibits a "PDF_SEO_LINK_FARM" heuristic, indicating a large number of external links. These links likely serve to manipulate search engine results or distribute further malicious content. The presence of numerous PDF links on various domains suggests a coordinated effort to host or redirect to malicious files.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mx.salonallurespa.ca/uploads/1/3/1/4/131437726/131437726.html#porsche+katalog+pdf
    • http://ouyangpmc.com/uploads/1/3/0/7/130739747/50372.pdf
    • http://glaciallakescounseling.com/uploads/1/3/1/6/131606947/biwifadide-jozibufa.pdf
    • http://iamterrarium.com/uploads/1/3/0/5/130588205/2aefe.pdf
    • http://luminousentities.com/uploads/1/3/0/5/130590177/woxomud_goromit_suxukoler_wabulimumef.pdf
    • http://chopyourownwood.com/uploads/1/3/0/7/130739061/2080953.pdf
    • http://elocinstudio.com/uploads/1/3/1/1/131163774/4486350.pdf
    • http://wonderland-lt.com/uploads/1/3/0/4/130476740/tinufepitax-givaroziked-xofokifanesegen.pdf
    • http://hengheyulecheng.br3h.com/uploads/1/3/0/5/130539090/ae42a12c90878e2.pdf
    • http://germanworldgrid.net/uploads/1/3/0/7/130738823/2fc2a69.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005aa6.bin
73ec4e0bd0b6a4e26fa549a192da925207311adbd31de6f9f213c27d7e298b21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AA6 5116 bytes
font_01_sfnt_off00006c1f.bin
43e4699896f07c301d4acc17fd56e947e0cead854868dea3c3058b4d81f6077d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C1F 10232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.