Malicious PDF — malware analysis report

Static analysis result for SHA-256 94d96cc836d69e92…

MALICIOUS

PDF

35.3 KB Created: 2020-04-23 01:55:10 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 639e550b59f2cd2fc19dadb4f65c1eba SHA-1: 71946c7a1a770f597fbeab1a1ac25205cb53ae91 SHA-256: 94d96cc836d69e92f11ed9fc16e8a2935ae16e7df7df4a453d61a04baeef909a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body suggests a lure related to business agreements, which is likely a pretext to encourage users to click on the embedded links. The primary attack pattern involves leveraging these links for SEO manipulation or to distribute further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://questioningpsychiatry.com/uploads/1/3/1/4/131438416/131438416.html#small+business+partnership+agreement+template+pdf
    • http://adoptme.info/uploads/1/3/0/6/130605426/vurotefixopuzuvusog.pdf
    • http://sbminerdesign.com/uploads/1/3/0/7/130776688/1424550.pdf
    • http://bigchillrefrigerationschool.org/uploads/1/3/0/8/130874490/9153367.pdf
    • http://amandawhetstone.com/uploads/1/3/0/7/130775180/1d74bb238cb76.pdf
    • http://shphotoss.com/uploads/1/3/1/0/131069961/mujujuvowilo-xaweb-luwigiriwo.pdf
    • http://transportedelnorte.com/uploads/1/3/0/4/130490808/cfb18741c9cc4ff.pdf
    • http://oceanpalmjewellers.com/uploads/1/3/1/3/131380623/wodugexukoxexogu.pdf
    • http://ressourcegenesis.ca/uploads/1/3/0/8/130874349/duguxixoj.pdf
    • http://jerrygarciamusic.com/uploads/1/3/0/3/130379075/66993b79aa7.pdf
    • http://blamatography.com/uploads/1/3/1/3/131384025/f96db30.pdf
    • http://greenscapeventures.com/uploads/1/3/1/4/131406801/1422433.pdf
    • http://mbd-designs.com/uploads/1/3/0/7/130776451/9750898.pdf
    • http://mommyandbee.com/uploads/1/3/0/4/130436006/joxer.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000637d.bin
e3c8e91da161df5594734ea9553adbc41696711a43e4a5afa796a9f51e71b74d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x637D 7512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.