Malicious PDF — malware analysis report

Static analysis result for SHA-256 9fd7d88e74725da0…

MALICIOUS

PDF

63.7 KB Created: 2020-04-13 23:27:49 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: be5b9b9f307f1186615d9acacc4a9351 SHA-1: 8ad392d3de907d46f67936b96f561a0cfe3c9b7d SHA-256: 9fd7d88e74725da0597129bc6d4f543977f94ab159d185984d89a5ed4546167f
102 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains a large number of external links, indicating a link farm or SEO spamming attempt. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests that the document may contain instructions for executing commands using Windows scripting tools. The primary intent appears to be directing users to a network of external websites, potentially for malicious redirection or content delivery.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michaelwellsart.com/uploads/1/3/0/5/130588617/130588617.html#she+dodie+clark+piano+sheet+music
    • http://gpacostruzioni.com/uploads/1/3/0/2/130288559/vopux.pdf
    • http://jews4trump.net/uploads/1/3/0/8/130814189/24caea7d.pdf
    • http://proutymotorsports.com/uploads/1/3/0/3/130323115/gekotine_xonos.pdf
    • http://raepiper.net/uploads/1/3/0/7/130739153/jinirazip_powozofomo.pdf
    • http://perceptionsoflouie.com/uploads/1/3/0/8/130874535/c23a15a401a.pdf
    • http://verdinpropertyphotos.com/uploads/1/3/1/4/131407494/7724531.pdf
    • http://instrumentalhands.com/uploads/1/3/0/6/130604613/ee4cc4355.pdf
    • http://septemberhouse.net/uploads/1/3/0/6/130604299/9464463.pdf
    • http://fayotopia.com/uploads/1/3/0/6/130620469/4e48a85700a.pdf
    • http://memorialbuildingandtheatre.org/uploads/1/3/1/0/131071315/ed1ac5152c6.pdf
    • http://hotelbuyouts.com/uploads/1/3/1/0/131070829/tadaraleruma-tiwanube.pdf
    • http://quizsource.com/uploads/1/3/1/6/131606476/b717c50a.pdf
    • http://guerrieritruckingllc.com/uploads/1/3/0/2/130270953/jusonik.pdf
    • http://donnajfraley.com/uploads/1/3/0/4/130477663/b1821.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b9db.bin
74d77ddadcdbbbbe18e0ff613fa2071b95392b5e2130dee471eb3d6e4d7f7146		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB9DB 9288 bytes
font_01_sfnt_off0000dd02.bin
0d355b956a9dff8708fe1b1ecbbec6815800202606c49a7e1bd1898687aadaa0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD02 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.