Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c90ba5de744c501…

MALICIOUS

PDF

62.4 KB Created: 2020-03-23 09:41:10 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 931c11b8ca601441a4ce89e1dfaa20a0 SHA-1: d11107223a48266e5a54b0bf7d2cda2b3fe37c63 SHA-256: 8c90ba5de744c501bbd782df403c9342d9386c2d6c7ab6fdcc71798f34e24064
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text is largely garbled but contains a Spanish phrase and references to translation software, suggesting a potential lure. The primary purpose appears to be directing users to a network of linked websites, likely for SEO manipulation or to host further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blacktreelofts.com/uploads/1/3/0/3/130313054/130313054.html#buenos+d%C3%ADas+traductor+espa%C3%B1ol+frances
    • http://www.newagevalue.com/uploads/1/3/0/7/130740591/153b175c0.pdf
    • http://nexacreativeconsulting.com/uploads/1/3/0/4/130435598/881b616c175582.pdf
    • http://gopuppyshuttle.com/uploads/1/3/0/5/130539102/zizisokusoni_burebifobori_dudok.pdf
    • http://magicopera.org/uploads/1/3/0/2/130274345/5182224.pdf
    • http://wailukuunionchurch.com/uploads/1/3/0/3/130323622/32e2a8aaa38df.pdf
    • http://texasfinesse.com/uploads/1/3/0/7/130775221/lepojupexidevipo.pdf
    • http://www.farmaciajomari.com/uploads/1/3/0/8/130814728/woxole_kowunuviwu_piwepuxibukar_tokijukipeg.pdf
    • http://www.bennettcoffeeroastingcompany.com/uploads/1/3/0/6/130621856/1148589.pdf
    • http://www.northernlight-bengals.de/uploads/1/3/0/6/130639231/pexokaxi.pdf
    • http://www.safedrycincinnati.com/uploads/1/3/0/6/130604065/1314001.pdf
    • http://www.teresacampbellviolin.com/uploads/1/3/0/2/130291910/068d1fc6.pdf
    • http://rambosiu.com/uploads/1/3/0/8/130813134/denogujadezegiseda.pdf
    • http://antiquessomewhere.com/uploads/1/3/0/3/130323355/jivupanidawegowese.pdf
    • http://cutjargon.com/uploads/1/3/0/4/130435898/85b168e4ee42.pdf
    • http://heatherholistics.com/uploads/1/3/0/4/130489240/8696ea6cdc4c9.pdf
    • http://mznaturallypatriciallc.com/uploads/1/3/0/6/130621426/fiposogepilawuvip.pdf
    • http://bellcreekagility.com/uploads/1/3/0/6/130604844/wuxikikajibusimavoji.pdf
    • http://savelet.org/uploads/1/3/0/7/130738641/4902935.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009d04.bin
e8eaad1472f228bd324ceed7248bbc1da49bf6902714f0abdb357bc4fc744d6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D04 11332 bytes
font_01_sfnt_off0000c120.bin
b64d6741cfec0aad0865d017b05e0e1fb7b4a6100249b802a3843c97d8d05181		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC120 4552 bytes
font_02_sfnt_off0000cfb5.bin
ff1df49bd8d3d9b5afa455194efb1aa37027ce0918a16f3888c56904caa4a7b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFB5 17156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.