Malicious PDF — malware analysis report

Static analysis result for SHA-256 9ff4a4bbb0bb38bc…

MALICIOUS

PDF

51.9 KB Created: 2020-03-26 04:00:40 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 60f271974da665453f0147a44d05c968 SHA-1: 0e86e9739c16f0013999805d5bda6b72285ca8f0 SHA-256: 9ff4a4bbb0bb38bcb965645760dec3c49208e7d2aaae78075867465847e1ba17
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. The document body text, though partially corrupted, includes the phrase "Planilha de gastos mensais simples download" which suggests a lure to download financial-related documents. The embedded URLs likely serve to redirect users to these malicious PDF files, potentially for phishing or further malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://twistedtumblers.org/uploads/1/3/1/0/131071249/131071249.html#planilha+de+gastos+mensais+simples+download
    • http://www.johnhandley.org/uploads/1/3/0/8/130813696/6949214.pdf
    • http://quitosltd.com/uploads/1/3/0/6/130620974/walurema.pdf
    • http://popularbymonteshac.com/uploads/1/3/0/9/130969939/lokuselezot-sutosadumuvu-vadom-zelopoki.pdf
    • http://www.products.veeartsy.com/uploads/1/3/0/6/130621593/2536956.pdf
    • http://www.imageconstruction.org/uploads/1/3/0/5/130542875/12d54af85c2f3e3.pdf
    • http://krulifejackets.com.au/uploads/1/3/0/9/130969264/kemupo.pdf
    • http://pokercasinofebruary.com/uploads/1/3/0/4/130490078/9ff53f88e.pdf
    • http://developmentsaustralia.com/uploads/1/3/0/7/130776206/5262231.pdf
    • http://dkgchiindiana.org/uploads/1/3/0/2/130272458/kizerojikotituz.pdf
    • http://www.fidesrepunte.us/uploads/1/3/0/6/130604415/nezirowavi_fojavopu_damigewemaxur_pusixaz.pdf
    • http://www.sameoldchic.com/uploads/1/3/0/6/130620417/menasema.pdf
    • http://dallaslivesinc.com/uploads/1/3/0/6/130621114/nodagoxubok.pdf
    • http://promarkpaintingservice.com/uploads/1/3/0/7/130740148/2300774.pdf
    • http://www.bellarosagarters.com/uploads/1/3/0/5/130588370/bijafizune-ligowadowupofeg.pdf
    • http://skydagger.com/uploads/1/3/0/7/130776504/6166897.pdf
    • http://zenlifestyleproducts.com/uploads/1/3/0/2/130287997/vujedarukinilawere.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009d08.bin
385f9304490c14764ef70e7ca6d4be5c54fa45c27d2ccb8c1ba2480c1fe9a532		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D08 10908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.