Malicious PDF — malware analysis report

Static analysis result for SHA-256 92e2a41ff4429d91…

MALICIOUS

PDF

54.2 KB Created: 2020-04-17 14:46:14 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 732dbb690baddc9357b7b46b60a959a7 SHA-1: 0df96ccd90bbd234914e7fe6ebe2c10e0644e86e SHA-256: 92e2a41ff4429d91f68599f9c404437e8a0e01d316f77cf77ef15d2fa5bf04e5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similar domains. This suggests a link farm or redirection mechanism designed to obscure the ultimate destination. The document body text, though partially corrupted, includes a URL that appears to be a lure for downloading books. No scripts were extracted from this sample. The primary attack pattern involves leveraging these links to redirect users to potentially malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://malasevskis.com/uploads/1/3/1/3/131381363/131381363.html#old+ayurvedic+books+in+marathi+pdf
    • http://tnems.net/uploads/1/3/0/9/130968967/4ed208b17.pdf
    • http://artsandhovercrafts.com/uploads/1/3/0/8/130813979/b30900b6e842da.pdf
    • http://ledbettermusiclessons.com/uploads/1/3/1/0/131069923/sosowumovofipu-vabijesaj-rofiduroz-tisila.pdf
    • http://domisolka.net/uploads/1/3/0/9/130969384/dutegulebipujukupem.pdf
    • http://marama.be/uploads/1/3/0/2/130291662/815069.pdf
    • http://themadkatter.com/uploads/1/3/1/0/131070113/39ba4029a.pdf
    • http://bratshop.co/uploads/1/3/0/6/130603823/jolubenibagobam.pdf
    • http://backyardist.com/uploads/1/3/0/8/130813514/e8147648d5ece5c.pdf
    • http://hemlytoolct.com/uploads/1/3/0/9/130969686/nowusalabeletetamu.pdf
    • http://finalfantasylover.com/uploads/1/3/1/0/131070294/fenopewe.pdf
    • http://tamparockbands.com/uploads/1/3/1/1/131163983/6032507.pdf
    • http://newmillenniummarketing.com/uploads/1/3/1/4/131436967/1410517.pdf
    • http://giveittogod.net/uploads/1/3/0/4/130435786/sewogaf-bizike.pdf
    • http://8333royalridgephotogallery.com/uploads/1/3/0/5/130543240/f37390dc318.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007750.bin
c5e3e482022655bddb0b6beae8fab9dab4599188d4b79576f7756f15f6970c6d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7750 7168 bytes
font_01_sfnt_off000093a1.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93A1 1388 bytes
font_02_sfnt_off00009b07.bin
382d9a551b461b901af9da10acfe3aeeb1461b661f30d73108570e3cc0ba2560		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9B07 16604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.