Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a19206d80756a14…

MALICIOUS

PDF

36.6 KB Created: 2020-03-17 03:25:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9654470e91703df321d50a32144b40e4 SHA-1: 1b6cbc32b26c629052b7785e3f13a3a5cb5837ec SHA-256: 9a19206d80756a14ebd1f9439623e0eab191b62e878dd98590c2d4c2d274fc1b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named and hosted on unrelated domains, indicating a link farm or SEO manipulation tactic. The document body mentions 'Grundfos pumpautomat mq 3-45', likely a lure to attract clicks to these external URLs. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://davidmarquesibanez.com/uploads/1/3/0/8/130874194/130874194.html#grundfos+pumpautomat+mq+3-45
    • http://nvssupply.com/uploads/1/3/0/3/130313056/juzezabunuxa.pdf
    • http://chillycool.org/uploads/1/3/0/9/130969041/6439642.pdf
    • http://kkleaning.com/uploads/1/3/0/6/130620729/3478420.pdf
    • http://watersidersnbpt.com/uploads/1/3/0/6/130639840/voxewilibavom-ladetageweladap-ratow-panoz.pdf
    • http://londoncitybears.com/uploads/1/3/0/8/130814407/pulapagonodub-mokevi.pdf
    • http://www.milkncookies.me/uploads/1/3/0/2/130272271/5511020.pdf
    • http://vomjubileehaus.com/uploads/1/3/0/6/130603922/donotelizazuputap.pdf
    • http://clubxboxpodcast.com/uploads/1/3/0/7/130739369/jugis.pdf
    • http://winorlosesportsconference.com/uploads/1/3/0/6/130639306/9489632.pdf
    • http://crossettcitypool.com/uploads/1/3/0/2/130288986/mosimure-jatiru-dipitasi.pdf
    • http://cwb4nepal.com/uploads/1/3/0/7/130776070/5116c2454e6.pdf
    • http://artm.services/uploads/1/3/0/9/130969185/bumoru.pdf
    • http://fanort.com/uploads/1/3/0/8/130814238/6f7e1.pdf
    • http://smashbroscardgame.com/uploads/1/3/0/7/130775756/5918351.pdf
    • http://www.thefriarsband.org/uploads/1/3/0/5/130544703/7264554.pdf
    • http://www.cyofficialpage.com/uploads/1/3/0/6/130621852/moxagabub-porifadosuwomo-mifexavunulaf.pdf
    • http://ldoublervending.com/uploads/1/3/0/2/130287537/5126234.pdf
    • http://www.sunsetsixers.com/uploads/1/3/0/6/130604255/8303331.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006539.bin
13b882e23e9941d5c9e60be97db7b749b3ba789b008b2ad2cbd7325eabdf97c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6539 8240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.