Malicious PDF — malware analysis report

Static analysis result for SHA-256 9487b944d9631343…

MALICIOUS

PDF

34.0 KB Created: 2020-05-04 12:14:52 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: db41b035e5a542f03131212b652b05cc SHA-1: e752595ab9a507b1343ebbadf34f64bd5bc3c8ed SHA-256: 9487b944d963134326d2bda7ffeb3247fdaeb32aebf88f235b20a889cb50e68d
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or SEO manipulation tactic. The presence of a 'download button' lure further supports the idea that the document is designed to encourage user interaction with these links. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cleansarasotafl.com/uploads/1/3/0/2/130270748/130270748.html#free+traceable+alphabet+worksheets+for+preschoolers
    • http://jeepish.net/uploads/1/3/0/8/130874498/4406699.pdf
    • http://stoppan.org/uploads/1/3/0/4/130488544/bfc1b3eb7c5e.pdf
    • http://ngbarmy.com/uploads/1/3/0/2/130287938/8337325.pdf
    • http://cementfab.com/uploads/1/3/0/3/130323709/7316117.pdf
    • http://parkstreetguesthousevt.com/uploads/1/3/0/9/130969353/wavibesunejafage.pdf
    • http://bigkatmanning.net/uploads/1/3/0/5/130551188/624464d.pdf
    • http://washingtondullesgateway.com/uploads/1/3/0/7/130776518/2636139.pdf
    • http://titanstage.org/uploads/1/3/1/3/131398606/mikurevetas.pdf
    • http://hdplumbing.net/uploads/1/3/1/0/131071041/757aeb710d86fb6.pdf
    • http://lalisanw.org/uploads/1/3/1/3/131380828/3548420.pdf
    • http://ukecigstorez.com/uploads/1/3/0/6/130621158/56a32d.pdf
    • http://deboraschiltmans.com/uploads/1/3/0/7/130738998/mixapi_moxabipebi_giwawalusapis_zapazabuxame.pdf
    • http://personalshoppinglady.com/uploads/1/3/0/7/130739159/kejemifazaxevuxevod.pdf
    • http://livinlavidaloca.net/uploads/1/3/0/7/130775800/dutibomuxexotin.pdf
    • http://1wayfinancial.com/uploads/1/3/0/8/130873820/zopokixew.pdf
    • http://tpvantransport.com/uploads/1/3/0/6/130621826/wunirulamatew.pdf
    • http://3siinc.net/uploads/1/3/1/3/131381414/xifisavo-vusazuton-xelifulaxumel-zopakasaje.pdf
    • http://ahavah.net/uploads/1/3/0/5/130539179/purigabev.pdf
    • http://solopes.com/uploads/1/3/0/2/130273738/zowaberaku.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059b6.bin
347abf3ee7999df83a488863a7599dbaa63bf7d0fe6e968100fad51683e1fb9e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59B6 10452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.