Malicious PDF — malware analysis report

Static analysis result for SHA-256 95a06cc0a37ff1e9…

MALICIOUS

PDF

36.3 KB Created: 2020-04-12 17:24:18 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7e6c5fd1237e3c1dd465d87749adfefa SHA-1: 3f15475586347b6ed584c03cd69761cc02c6c8a5 SHA-256: 95a06cc0a37ff1e9d6fab6e2c669184d3e70803c9ccf071e420b2f9d01976031
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a method to distribute malicious content. The embedded URL also directs to an external HTML page, further supporting the attack pattern of luring users to external resources. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://torcontracting.net/uploads/1/3/1/3/131381717/131381717.html#objetivos+de+una+practica+profesional+docente
    • http://youngmanufacturersassociation.com/uploads/1/3/0/6/130620789/7a88819d.pdf
    • http://aussiewealthsuper.com/uploads/1/3/0/7/130738940/6941039.pdf
    • http://b-24-thegreenhornet.net/uploads/1/3/0/6/130620750/nejutojiwot-gasamupotexebij-mubimupixis-pizuguduvugiloz.pdf
    • http://microweddingsnyc.com/uploads/1/3/1/3/131398350/3836773.pdf
    • http://microsoftproposalstlouis.com/uploads/1/3/0/7/130775700/xaxav-pafujoxazeje.pdf
    • http://stmatthewsvoorheesville.com/uploads/1/3/0/7/130738831/6436889.pdf
    • http://internshipadvisor.com/uploads/1/3/1/1/131164118/8787474.pdf
    • http://smart-touchscreen.com/uploads/1/3/0/5/130539059/bobed_lemejolag_mapux.pdf
    • http://abylcoaching.com/uploads/1/3/0/7/130776399/2708902.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000657f.bin
0f9bf0ede861e8c9ae46fb647b96d2442a760d4d441c4efbd7358ef232c12468		 pdf-font-stream PDF embedded font (sfnt) at offset 0x657F 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.