Malicious PDF — malware analysis report

Static analysis result for SHA-256 90497a8c2d6e7760…

MALICIOUS

PDF

41.8 KB Created: 2020-03-13 02:00:55 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5e46476f3c11f6d28f94de587e7c9005 SHA-1: 016f7962242151cc756aba6468c6448a91eb44f6 SHA-256: 90497a8c2d6e77607c277f01923474cd5f4efe10ced833da593faa065eb3c868
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or SEO manipulation tactic. The document body, though partially corrupted, contains a title related to isomerism and mentions the wkhtmltopdf tool, indicating it was likely generated programmatically. The primary intent appears to be directing users to a vast collection of external PDF files, potentially for malicious distribution or SEO spam.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://teamgls.com/uploads/1/3/0/8/130813818/130813818.html#difference+between+optical+isomerism+and+geometric+isomerism
    • http://losruisenoresantigua.com/uploads/1/3/0/8/130814360/8908377.pdf
    • http://aliahjan.co.nz/uploads/1/3/0/8/130813800/64bafa82a5b45e2.pdf
    • http://conventusmedia.net/uploads/1/3/0/7/130776300/3e07183.pdf
    • http://www.loveejade.com/uploads/1/3/0/5/130590138/133ac434077be.pdf
    • http://www.couicksconcretefinishing.com/uploads/1/3/0/2/130289259/f07f0.pdf
    • http://projecteagleatl.com/uploads/1/3/0/5/130588702/a2e50c865a12cd6.pdf
    • http://www.lthomas.ca/uploads/1/3/0/8/130874272/vesola_mawulasamazegi.pdf
    • http://www.jazztoneghana.com/uploads/1/3/0/7/130775668/kenalipakimo.pdf
    • http://basiccomputertutoring.com/uploads/1/3/0/7/130740130/xonexatan.pdf
    • http://goodvibespetcare.com/uploads/1/3/0/5/130590436/semejo.pdf
    • http://jasondjackson.org/uploads/1/3/0/7/130738525/paxuxubugoxagotujoxe.pdf
    • http://themodestcollection.com/uploads/1/3/0/4/130476844/wazitijise.pdf
    • http://cleaningstgeorge.com/uploads/1/3/0/5/130588220/9725cb4998a.pdf
    • http://www.wallisgateaux.com/uploads/1/3/0/7/130739175/karabokarefazut-gozasagawazaji-rikeximubojemat.pdf
    • http://archesbrewinggallery.com/uploads/1/3/0/5/130550758/vatanat.pdf
    • http://www.luminarydistillery.com/uploads/1/3/0/5/130543310/3095760.pdf
    • http://cristalbay.com/uploads/1/3/0/6/130620543/278003.pdf
    • http://stephblair.com/uploads/1/3/0/4/130436258/kofajupovixas-wobuzurukula.pdf
    • http://www.powerlaunching.com/uploads/1/3/0/6/130621432/0ae5a9c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007790.bin
b61127907af63b98ed953f65fd310ba80e75ab70e54a70146946883631c5b129		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7790 8396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.