Malicious PDF — malware analysis report

Static analysis result for SHA-256 9e2a2cd6ba1f231e…

MALICIOUS

PDF

35.2 KB Created: 2020-03-23 02:48:49 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 75e7772baff45912b4ae7ecc470dfd7a SHA-1: f1d21c32540413444d8e3a5eaae4ee74622a6ffa SHA-256: 9e2a2cd6ba1f231e98233d9e54d39f066c3ab9242a8308b3e1a0938957c16683
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The document body, though partially garbled, suggests a lure related to 'Ejercicios de powerpoint 2010 para niños' (PowerPoint exercises for children). The primary heuristic indicates a link farm strategy, aiming to drive traffic to numerous domains, likely for phishing or malware distribution. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://preecelightning.com/uploads/1/3/1/1/131163774/131163774.html#ejercicios+de+powerpoint+2010+para+ni%C3%B1os
    • http://mylittlemutant.com/uploads/1/3/0/5/130539235/c6e37908.pdf
    • http://www.icis-bad-woerishofen.com/uploads/1/3/0/6/130621036/wevujomozogev.pdf
    • http://aisagency.net/uploads/1/3/0/9/130969514/88adc.pdf
    • http://www.singlegirldesign.com/uploads/1/3/0/7/130776308/japatobed.pdf
    • http://www.antigofurniture.com/uploads/1/3/0/5/130589401/bebabiza.pdf
    • http://decentralizedcoin.org/uploads/1/3/0/6/130603926/9204030.pdf
    • http://beautyshitwithalisonharper.com/uploads/1/3/0/3/130313113/846ad765d.pdf
    • http://cmconsultancyservices.com/uploads/1/3/0/8/130813883/ca1c2f41.pdf
    • http://restoringhopecounseling.net/uploads/1/3/0/4/130488885/7279c2.pdf
    • http://tayleighfit.com/uploads/1/3/0/4/130435966/3815405.pdf
    • http://bluecalliope.com/uploads/1/3/0/5/130540085/8727242.pdf
    • http://mrspiacentini.com/uploads/1/3/0/6/130621426/voxonixifig.pdf
    • http://www.letsplayfarsi.com/uploads/1/3/0/8/130873992/tetevowu.pdf
    • http://arizonainstruction.com/uploads/1/3/0/5/130542985/tiviwebonu.pdf
    • http://inavintagecruiserrv.com/uploads/1/3/1/0/131069923/ee0b1ba9ce87cb5.pdf
    • http://nutrologiadecaesegatos.com/uploads/1/3/0/6/130604576/zobujefagiwa-mopigolasa-rinebajarov.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ebd.bin
3ebdf8d24a7d783010e684917b2d64e3b517cd8411b94cb83b1d4a3bf5db6019		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EBD 8332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.