Malicious PDF — malware analysis report

Static analysis result for SHA-256 9f150222d8cc65ee…

MALICIOUS

PDF

40.8 KB Created: 2020-03-28 05:20:44 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 828d0e5c177a174f6098c17edd16a4b4 SHA-1: e12468e6551f5873e5e292006b8b2bc875d9978a SHA-256: 9f150222d8cc65eee8a2931b40f817fe8aa3fe52834676bbd445943a876d0d6f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a phishing campaign. No scripts were extracted from this sample. The primary attack pattern observed is the distribution of malicious links within the document.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bridgestreampublishing.com/uploads/1/3/0/2/130271002/130271002.html#division+de+dos+numeros+en+ensamblador
    • http://metlifelostpensions.com/uploads/1/3/0/6/130620501/6175138.pdf
    • http://pcs1.com/uploads/1/3/0/7/130775027/8691863.pdf
    • http://thewindhorsecenter.com/uploads/1/3/0/5/130539516/peporulodu-gupom.pdf
    • http://www.jetcraze.com/uploads/1/3/0/6/130639177/b999d1193a.pdf
    • http://intashell.com/uploads/1/3/0/5/130589230/454da0.pdf
    • http://denisechristie.com/uploads/1/3/0/5/130543511/gazukasizizivilezox.pdf
    • http://timsyth.com/uploads/1/3/1/0/131071056/tulabetuwavexudepamu.pdf
    • http://eatlocalexpokc.com/uploads/1/3/0/3/130313319/355994.pdf
    • http://www.gvagsociety.ca/uploads/1/3/0/2/130288571/nizufimazogusogufe.pdf
    • http://savemyrelationship.ca/uploads/1/3/0/8/130874470/82a8a0d.pdf
    • http://www.aftercareusa.studio/uploads/1/3/0/4/130490193/e48cd.pdf
    • http://whitegravity.com/uploads/1/3/0/6/130620578/7636314.pdf
    • http://stupidwork4u.com/uploads/1/3/0/3/130312998/bojinimekafenovifiki.pdf
    • http://apostolicadventures.com/uploads/1/3/0/7/130738777/1eeabb624d1.pdf
    • http://www.brandonlovesraechel.com/uploads/1/3/0/8/130813722/nupojajupa.pdf
    • http://churchstrettontaxi.com/uploads/1/3/0/8/130814510/foxudawojevus_zibekuxiwas.pdf
    • http://irvinelaserhair.com/uploads/1/3/0/5/130551925/1374aae7.pdf
    • http://gianmariafranchetto.com/uploads/1/3/0/5/130545001/96e1ae3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007180.bin
166b5d5731774b4e4fe283c3020ab2c84657aff740c7c99c3a1c5704b5752a38		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7180 10036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.