Malicious PDF — malware analysis report

Static analysis result for SHA-256 8dba4169b364202d…

MALICIOUS

PDF

44.9 KB Created: 2020-06-07 01:18:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4817b02c985ff0ff2f22a7530cdb3042 SHA-1: 3e0e23180f9e9fffe3c0f328a452bd6c4e04e4d3 SHA-256: 8dba4169b364202dc0c067738fd932bf5c165c923b73c4d29d8173dfbe919e88
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to a network of domains. The document body, though partially corrupted, includes a URL that matches one of the extracted links, suggesting a lure related to a 'Parrot headphone review'. The primary function appears to be directing users to a link farm designed to host or redirect to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://a1cwise.org/uploads/1/3/0/3/130323130/130323130.html#parrot+headphone+review
    • http://renewportinc.org/uploads/1/3/1/4/131438109/cea3cda4a14f73.pdf
    • http://shopbelfast.info/uploads/1/3/0/9/130969558/1bd218.pdf
    • http://bellpace.net/uploads/1/3/1/1/131164506/kemaxoz-sirijifixuxebe-tobezabig-poxame.pdf
    • http://peninsulalawnsandgrounds.com/uploads/1/3/0/7/130738714/zojoxotupo.pdf
    • http://adminlige.com/uploads/1/3/0/7/130740385/vinawodimidofu-jibovitoboj.pdf
    • http://mail.livingwhole.net/uploads/1/3/0/6/130604860/9cd1f68f38de.pdf
    • http://a1322869xstreamtravel.xsideas.com/uploads/1/3/0/2/130289577/pofed.pdf
    • https://monuzixomiju.files.wordpress.com/2020/06/lubirepaf.pdf
    • https://sunokowezepe.files.wordpress.com/2020/06/xovugajeba.pdf
    • https://xolupola.files.wordpress.com/2020/06/durosotazirigimexuf.pdf
    • https://jupeveni.files.wordpress.com/2020/06/luzajekut.pdf
    • https://kusibofax.files.wordpress.com/2020/06/80793082628.pdf
    • https://babebevofam.files.wordpress.com/2020/06/32399429832.pdf
    • https://gujobuzagam594322867.files.wordpress.com/2020/06/81846697151.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000825e.bin
ace3a917bfef21df356b74ed436a758063e809b2c6d2d0030009db1b108380a7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x825E 11084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.