Malicious PDF — malware analysis report

Static analysis result for SHA-256 89b8e1d5eab0e1d4…

MALICIOUS

PDF

37.3 KB Created: 2020-04-09 06:23:52 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8ba17dbc3823176a25965e086200191a SHA-1: f7cd0d1bc5eb89986d8ce8ca01d43a7e10295184 SHA-256: 89b8e1d5eab0e1d498279484cd3fe6eeed1ac71c2d0cd372ce96487b6ac2b21e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary URL found in the document body, http://thebusinesstip.com/uploads/1/3/1/3/131383562/131383562.html#conversion+mililitros+a+centimetros+cubicos, is part of this link farm. This suggests a tactic to manipulate search engine results or to distribute malicious content through a network of seemingly unrelated websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thebusinesstip.com/uploads/1/3/1/3/131383562/131383562.html#conversion+mililitros+a+centimetros+cubicos
    • http://academicyoga.com/uploads/1/3/0/2/130289427/6316417.pdf
    • http://drumloughpipeband.com/uploads/1/3/1/4/131483170/7831398.pdf
    • http://quantmntl.com/uploads/1/3/1/3/131381882/botiduwo.pdf
    • http://leadersofanewyou.com/uploads/1/3/0/6/130621798/5562eb518b.pdf
    • http://midwestduallanguage.com/uploads/1/3/0/5/130540280/kaxuxonepat_xexubu_judejoweg.pdf
    • http://msgarletts-hancock.com/uploads/1/3/0/6/130620788/1912252.pdf
    • http://keystonesportsmensalliance.com/uploads/1/3/1/4/131437669/ripukok.pdf
    • http://evergladesorganics.com/uploads/1/3/0/6/130604195/fesofegod_pubokupobabefuj_butodazeniju_tanokimepego.pdf
    • http://ddswe.com/uploads/1/3/0/2/130289213/tunejukuwe-waxeres-jerib.pdf
    • http://siliconvalleymarchforwomensrights.com/uploads/1/3/0/5/130588403/7340341.pdf
    • http://lrasmussenillustration.com/uploads/1/3/1/0/131071175/6478288.pdf
    • http://pescado-gabon.net/uploads/1/3/0/8/130873984/1dec17107258.pdf
    • http://natureiraqfoundation.org/uploads/1/3/0/4/130483477/xirorizakimejuzomej.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006abc.bin
fdfab46ca030632f790f4cb9993d9bd3fd508d6590f97e2b6e2d3d58a59f2c9c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6ABC 7300 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.