Malicious PDF — malware analysis report

Static analysis result for SHA-256 9540d49102562c0a…

MALICIOUS

PDF

35.2 KB Created: 2020-04-16 08:16:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7ba58772a2575cf796b8134426d9543b SHA-1: c0c65f92396e051181a549b62f53ce535249332b SHA-256: 9540d49102562c0a223bc322bd630c5389a6bfc3315ec59ef27a33f01dc10f73
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, indicating it functions as a link farm. The heuristic PDF_SEO_LINK_FARM specifically flags this behavior, suggesting an attempt to manipulate search engine results or direct users to potentially malicious content. The document body contains garbled text and a URL, further supporting the link farm hypothesis. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://militaryaviationposters.com/uploads/1/3/1/6/131636956/131636956.html#choodiyan+song++bestwap+new
    • http://avalashco.com/uploads/1/3/0/3/130323554/7808529.pdf
    • http://karintell.se/uploads/1/3/0/3/130313155/xiwejinalobokun.pdf
    • http://trend36fashion.com/uploads/1/3/0/7/130739445/7357557.pdf
    • http://fd150lariat.com/uploads/1/3/0/3/130313434/8960051.pdf
    • http://heritagemusic.ca/uploads/1/3/0/8/130813095/boroxa_kixomoxusoza_telolujox_buluvawo.pdf
    • http://pacificcoastbuyers.com/uploads/1/3/0/7/130776368/guvuxoxuna_xoxolusagux_kegelijuduge_mezixojuk.pdf
    • http://annagramphotography.com/uploads/1/3/0/6/130603955/40abb0ae7fbe.pdf
    • http://surrendermenot.com/uploads/1/3/0/5/130540683/mudojizojokil.pdf
    • http://kkmediaagency.com/uploads/1/3/1/3/131379382/tupufiwudozodudu.pdf
    • http://nhatrangpartytown.com/uploads/1/3/0/2/130272432/604db10.pdf
    • http://surrendermenot.com/uploads/1/3/0/5/130540683/mudojiz
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061ad.bin
9d45d10d437e140a7096971d746fcf64c418fa2c770678fe59c0bfa09fd50fb5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x61AD 8128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.