Malicious PDF — malware analysis report

Static analysis result for SHA-256 92f98ce141a47334…

MALICIOUS

PDF

53.5 KB Created: 2020-05-02 20:01:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8b41b8483c8544dfce7d147734299bea SHA-1: fe0cef13c1655ed476ce88ab79d88db7ee5c6f6a SHA-256: 92f98ce141a47334dca4200343ced6dd43fa0d976a2ea38653d3bf59ea04eb3c
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure related to 'Brush stroke lettering practice sheets' but is primarily a link farm. It hosts numerous external links, with a critical heuristic identifying it as a PDF SEO link farm. The primary purpose appears to be driving traffic to a large number of other PDF files hosted on various domains, likely for SEO manipulation or to distribute further malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rebeccalaplacaattia.com/uploads/1/3/0/6/130620646/130620646.html#brush+stroke+lettering+practice+sheets
    • http://russellvphoto.com/uploads/1/3/0/4/130476417/bbc4c4cb96340.pdf
    • http://slachterfarms.com/uploads/1/3/0/4/130494059/8114195.pdf
    • http://viktorzemlicka.info/uploads/1/3/0/6/130622084/5871644.pdf
    • http://brooksexcavation.org/uploads/1/3/1/1/131163658/80038d766f235bb.pdf
    • http://tenzon.org/uploads/1/3/1/4/131482946/bufovut.pdf
    • http://moodstylehaus.com/uploads/1/3/0/7/130739561/da8c5.pdf
    • http://stricklandoutdoorsupply.com/uploads/1/3/1/0/131070314/vafitiziferur.pdf
    • http://bayareaqueertheater.com/uploads/1/3/0/5/130540040/xevediwavinur.pdf
    • http://justinfrazierrealty.com/uploads/1/3/1/4/131452904/pipawo.pdf
    • http://cropdefenderworks.com/uploads/1/3/1/6/131637374/5756120.pdf
    • http://masugalipzqueenscosmetics.com/uploads/1/3/1/6/131606673/jutizetowajuval_dimel_doluri_warabelivetu.pdf
    • http://geekquilt.com/uploads/1/3/0/6/130603939/rafol.pdf
    • http://vaporservices.org/uploads/1/3/1/3/131379296/4139853.pdf
    • http://www.brchwear.com/uploads/1/3/0/4/130483848/kivuxogix-kafubevuxiso-vokuzibivofed.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000907a.bin
7e922df26e933aaf653e91260b3c7941f0e7d1ab60320649321a60389282d892		 pdf-font-stream PDF embedded font (sfnt) at offset 0x907A 9052 bytes
font_01_sfnt_off0000b326.bin
9fde67ddcb38ee50c8dffe07e5fb2fa960445b65cbcaa229fd29a3cbaf7f008b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB326 16328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.