Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cfa1407bafc7ac5…

MALICIOUS

PDF

39.4 KB Created: 2020-03-20 13:09:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 64d3d073224d264b4e83258bde1a7ab4 SHA-1: 71dac6364f7d924072b23c2530958211334b2007 SHA-256: 8cfa1407bafc7ac52f49e32b82c694e1f55af83db9cfda2f42823cf85b525db7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to numerically-slugged PDF files on various domains. This pattern is indicative of a link farm or a traffic distribution system designed to obscure the ultimate destination. The document body itself contains metadata and a single URL that appears to be part of this network. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aoc-pco.com/uploads/1/3/0/7/130740206/130740206.html#whirlpool+accubake+precise+clean+instructions
    • http://webdisk.corvetteslimited.com/uploads/1/3/0/8/130815381/2902582.pdf
    • http://sportspine.net/uploads/1/3/1/1/131163763/sezunagozarika_zowamamevaxak_nukodudofafiti.pdf
    • http://crestanello-sett.com/uploads/1/3/0/5/130590036/muropusufumusabeba.pdf
    • http://rinjaniakria.com/uploads/1/3/0/4/130436162/dekokajazuziz-gelalu-saduzo-bekozed.pdf
    • http://www.beaconhomesandinvestments.com/uploads/1/3/0/5/130546657/fesevuxivalisuk.pdf
    • http://newyorkdiamondbling.com/uploads/1/3/0/7/130738789/nunokanuv_pesefilokitig_milonidodibil_xizonafe.pdf
    • http://napavalleybus.com/uploads/1/3/0/7/130739974/pawavuxane_misagafekek.pdf
    • http://webmail.mrk9inc.org/uploads/1/3/0/5/130540619/koguz.pdf
    • http://petsingoodhealth.com/uploads/1/3/0/8/130874292/fevunovuzal-midofivi.pdf
    • http://abcc-am.org/uploads/1/3/0/7/130739211/304292.pdf
    • http://alanaparks.com/uploads/1/3/0/9/130969571/3913789.pdf
    • http://www.kk9walks.com/uploads/1/3/0/6/130620302/8170191.pdf
    • http://laurenvirginiaalbert.com/uploads/1/3/0/4/130483900/garepizadufolo_xetazo_wudego.pdf
    • http://ddeusa.com/uploads/1/3/0/6/130620399/momukepisixiro.pdf
    • http://nightowlinvestments.com/uploads/1/3/0/7/130739034/bigis_vivorefubifi_kajavaf.pdf
    • http://lovellaweddings.net/uploads/1/3/0/2/130289179/xigib-mizamopak.pdf
    • http://mishareads.com/uploads/1/3/0/5/130544086/8508ad.pdf
    • http://airporthoppermaynooth.com/uploads/1/3/0/2/130272500/fedoka.pdf
    • http://worldwidegreatescapes.com.au/uploads/1/3/0/6/130639220/6ab988e.pdf
    • http://reachingthemasses.net/uploads/1/3/0/4/130476611/mazadux-sejapebaseju.pdf
    • http://morlok.com/uploads/1/3/0/6/130621912/6918366.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007249.bin
7efb57310c695924338f78cba8fb75467c09a7fe32fea8a8d81901c477cb5152		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7249 7540 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.