Malicious PDF — malware analysis report

Static analysis result for SHA-256 9dc1ab29e5e592f1…

MALICIOUS

PDF

34.2 KB Created: 2020-03-25 13:06:11 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8c53cf98d3a7e9b6a87ed615228604b7 SHA-1: 0b1dc521543a739477918c982b13c68075e38346 SHA-256: 9dc1ab29e5e592f1e719e2c05e121b1a5d553b9aec257521ec4a74f54ff5e6cb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The embedded URLs point to various domains, suggesting a link farm or a distribution point for malicious content. The document body is heavily obfuscated and contains some of the same URLs, reinforcing the link-farming attack pattern.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adriekeosmun.com/uploads/1/3/0/5/130588150/130588150.html#list+of+stata+commands+pdf
    • http://giacintatalarico.com/uploads/1/3/0/7/130740502/visazo-suvobetowut-dekizo.pdf
    • http://www.kickassstuffcompany.com/uploads/1/3/0/3/130323126/2461456.pdf
    • http://shpahregion.org/uploads/1/3/0/4/130476401/836674e0ba.pdf
    • http://tilexllc.com/uploads/1/3/0/7/130738914/53320cbae9.pdf
    • http://www.stewart-marine.com/uploads/1/3/0/5/130539837/fofilataxakapo_mowav_piwitija.pdf
    • http://www.brothershalal.com/uploads/1/3/0/6/130622084/botuwebawudibajexima.pdf
    • http://betterbartlettschools.org/uploads/1/3/0/5/130589261/8241362.pdf
    • http://www.cowboycalendars.com/uploads/1/3/0/4/130435876/9734918.pdf
    • http://nicolejonestroy.com/uploads/1/3/0/3/130313619/desozikex.pdf
    • http://ararecloth.shop/uploads/1/3/1/1/131163960/rojuduwutusikunile.pdf
    • http://solitudeandsilence.org/uploads/1/3/0/4/130436018/465a3695099.pdf
    • http://fmtimove.com/uploads/1/3/0/5/130540585/cafb37482760c.pdf
    • http://shabbybungalow.com/uploads/1/3/0/7/130739214/41058f6e99.pdf
    • http://grovecitycarsandcoffee.com/uploads/1/3/0/3/130379462/222704.pdf
    • http://www.texascraftfairy.com/uploads/1/3/0/7/130740498/duxojobaku_ditazuleguma_dozuzol_sonipizi.pdf
    • http://johnhenryfox.com/uploads/1/3/1/0/131070437/gekopigijol-romukesu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005cd1.bin
8db7fd9cd5c49adb6fb8d24faf386be8aca5d3b1cb76cc239e57c5779c0229c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5CD1 7584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.