Malicious PDF — malware analysis report

Static analysis result for SHA-256 9038b16e094437d3…

MALICIOUS

PDF

25.0 KB Created: 2020-03-16 17:48:55 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7511145132c1dc176d85c6a21e9d4175 SHA-1: 8c216afde1dfa62384982938f64188948d2f163e SHA-256: 9038b16e094437d3207d3cc17f971d20229dfd9e8cd49ec4913e559519a031d8
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or a mechanism to distribute malicious content. The document body, though partially corrupted, contains a reference to calculating the area of a circular sector, likely a lure to disguise the malicious intent. No scripts were extracted, but the extensive use of external links suggests a phishing or content distribution attack.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hthnails.com/uploads/1/3/0/2/130272361/130272361.html#como+se+calcula+el+area+del+sector+circular
    • http://neworglisbon.com/uploads/1/3/0/5/130551116/e1b144b49ba.pdf
    • http://ballyhuni.com/uploads/1/3/0/8/130813357/67604858cd10e2d.pdf
    • http://rightpointclinic.com/uploads/1/3/0/5/130544781/muvarig.pdf
    • http://ww3.westwaycapital.com/uploads/1/3/0/5/130550940/77114.pdf
    • http://porqueeseidiotasevetanbienyyono.com/uploads/1/3/0/6/130604225/7f4fa11.pdf
    • http://mail.thespicycowgirl.com/uploads/1/3/0/7/130775138/boxonik.pdf
    • http://paypal.octarinesec.com/uploads/1/3/0/2/130289259/misubuwudovugawifi.pdf
    • http://warmouthgolf.com/uploads/1/3/0/8/130813883/geverewikibenu.pdf
    • http://mail.corallinks.com/uploads/1/3/0/7/130740622/gekemupidigapawe.pdf
    • http://3fweixin.com/uploads/1/3/0/6/130603903/9868777.pdf
    • http://ngashstudio.com/uploads/1/3/0/5/130539448/5f005.pdf
    • http://queenbeeglamqueen.com/uploads/1/3/0/6/130604446/jikevurezijuso.pdf
    • http://darkmatrix.net/uploads/1/3/0/7/130775217/9448601.pdf
    • http://ablehorsewomanship.com/uploads/1/3/0/7/130776072/jepuruzi.pdf
    • http://duchangqianshudushujiemi.jhamrick.com/uploads/1/3/0/2/130271067/6573467.pdf
    • http://cpt-you-are-not-alone.com/uploads/1/3/0/4/130483200/4522045.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.