Malicious PDF — malware analysis report

Static analysis result for SHA-256 9eb76593f795160f…

MALICIOUS

PDF

40.3 KB Created: 2020-03-08 06:49:03 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 79c1c0bce131b2b15206b855eb233c8d SHA-1: a657561cb68a4bb304978946a3b81ba58bf44f37 SHA-256: 9eb76593f795160f8fe8e9c7d51a4162a8182684525982de734f9d913260acfd
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, many of which point to other PDFs. The document body text mentions 'Trane chiller software free download', suggesting a lure to trick users into clicking these links. The PDF_SEO_LINK_FARM heuristic indicates a link farm pattern, commonly used for SEO spam or to distribute malicious content. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sales12-sip-phone.pleasingfood.com/uploads/1/3/0/7/130776073/130776073.html#trane+chiller+software+free+download
    • http://spatzen.hu/uploads/1/3/0/4/130489448/wusaf.pdf
    • http://ecolevandyke.com/uploads/1/3/0/8/130814666/zekizat.pdf
    • http://cpanel.radioiskrica.com/uploads/1/3/0/4/130477201/lalizezulinoz_forok_wexatezud.pdf
    • http://wingsofhealing.global/uploads/1/3/0/7/130776233/dilifutaxegebod.pdf
    • http://www.acabsolutions.com/uploads/1/3/0/7/130739298/1a1f59b0f0.pdf
    • http://lapuertadelsolshop.com/uploads/1/3/0/5/130543536/wabasedofaguj-sadanukupabebe.pdf
    • http://legolasgoldens.net/uploads/1/3/0/2/130272579/wenotenavemusup.pdf
    • http://madmazzdesign.com/uploads/1/3/0/6/130605017/f53604f19c9.pdf
    • http://diamondstorehawaii123.club/uploads/1/3/0/2/130289651/tifusepiluramo.pdf
    • http://www.havocairsoft.co.uk/uploads/1/3/0/7/130739120/12c901db49abb.pdf
    • http://n30.cloud/uploads/1/3/0/2/130271243/jomogivat.pdf
    • http://aylestoneallotments.org/uploads/1/3/0/7/130776605/0b7ced6800.pdf
    • http://magnaforklift.com/uploads/1/3/0/7/130776887/gerikanejiwa.pdf
    • http://xplanator.com/uploads/1/3/0/5/130551127/9690892.pdf
    • http://smallrental.com/uploads/1/3/0/6/130639936/wonis.pdf
    • http://3dmo1.bpmtc.com/uploads/1/3/0/2/130271121/5882164.pdf
    • http://www.cloud.sentinel-air.com/uploads/1/3/0/7/130739656/foxamipobeja-tivenibidovajin.pdf
    • http://alegriahotelsxm.com/uploads/1/3/0/2/130288883/30f5e3.pdf
    • http://hawkins-mediation.com/uploads/1/3/0/4/130488696/tijuxerijizaxag.pdf
    • http://two-type-keyboard.com/uploads/1/3/0/7/130775462/zojolita_sapizorakigu_witusugitefigeb.pdf
    • http://macscanteen.com/uploads/1/3/0/3/130323175/fuwawezeduvoxolerop.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000755b.bin
e47d9214169234984ee57f68341175c7c88a5818fd6be502fc3c6c70e9b16f3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x755B 7684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.