Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c717f9089abe879…

MALICIOUS

PDF

35.0 KB Created: 2020-04-17 07:33:02 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4e6ba3e5e51ae7f033775e593a327b77 SHA-1: 965c4b700810ec8a382689df66f6f926c4a132c8 SHA-256: 9c717f9089abe879d765e79189091c6ee8d37de357b172316afd8ebb71168aff
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which appear to be SEO-driven lures. The document body, though heavily obfuscated, contains text related to 'Xfinity tv guide listings', suggesting a social engineering pretext. The primary heuristic indicates a link farm, with multiple URLs pointing to similarly structured paths on various domains, likely intended to distribute malware or conduct phishing.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reboundat.com/uploads/1/3/0/3/130323817/130323817.html#xfinity+tv+guide+listings+for+tonight
    • http://massage-logic.org/uploads/1/3/0/8/130813606/000a3b4.pdf
    • http://ofisnedorogo.ru/uploads/1/3/1/3/131383613/3077485.pdf
    • http://brandon3d.com/uploads/1/3/0/6/130639827/nutifekutegejak_fenekafojevudot_wimukunifub_jusijilokutolas.pdf
    • http://jumpyjoe.com/uploads/1/3/0/6/130639500/finutatikejoxero.pdf
    • http://kopimbahmeru.store/uploads/1/3/0/2/130289658/3533377.pdf
    • http://healdsburgwickedslush.net/uploads/1/3/0/4/130489055/kobine.pdf
    • http://oracleessentia.com/uploads/1/3/0/7/130739169/3064124.pdf
    • http://youngsfamilyfurnishings.com/uploads/1/3/1/3/131398133/9fa08c7cf63e1.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006281.bin
cee3e7545b822c923bd9f478d5a716d8c437ce64790fdfcb199f63992ee2a565		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6281 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.