Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0254a807ba83cdc…

MALICIOUS

PDF

41.3 KB Created: 2020-03-25 13:00:23 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6e40aa57c2ba0e9b2b243a1255201d55 SHA-1: 9824c0a01525cdf29ca70f61c7faf50d0719e92e SHA-256: a0254a807ba83cdc4a46af7fbf80e6df10ad05919a2db0947a9f8a630cbacf0f
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. The document body text, though partially corrupted, contains a medical term ('Icd 10 code for subserosal fibroid') and references the authoring application 'wkhtmltopdf', suggesting a potential SEO spam or link farm tactic. The primary intent appears to be directing users to a network of linked content, likely for malicious advertising or to host further malicious payloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jyoong.com/uploads/1/3/1/3/131384101/131384101.html#icd+10+code+for+subserosal+fibroid
    • http://blitzfreight.com/uploads/1/3/0/7/130776805/nikebaterepiliju.pdf
    • http://motelpoinsettia.net/uploads/1/3/0/7/130739806/tevekun.pdf
    • http://acecon.net/uploads/1/3/0/2/130291575/dofanebira.pdf
    • http://ashajna.com/uploads/1/3/0/4/130489075/fesijimunifiwe.pdf
    • http://160797321165414815.com/uploads/1/3/0/5/130590029/tukivif_supegukupo_dizilafeka_rasibivugun.pdf
    • http://oneacupunctureclinic.com/uploads/1/3/1/1/131163863/ef618.pdf
    • http://www.magnificentliverpooltours.co.uk/uploads/1/3/0/3/130313199/4347752.pdf
    • http://mx.ankmasonry.com/uploads/1/3/0/6/130639513/2068804.pdf
    • http://www.golfconnectsne.com/uploads/1/3/0/7/130775672/dizuzolileles_buniravok.pdf
    • http://ddoconsultoria.com/uploads/1/3/0/4/130489082/fdd270b8.pdf
    • http://nc956.com/uploads/1/3/0/7/130776616/bametomoxuzepex-jopirizuv.pdf
    • http://mx.theglasscarousel.com/uploads/1/3/0/7/130739962/2610375.pdf
    • http://www.bennettdalton.com/uploads/1/3/0/5/130550971/5218792.pdf
    • http://hostmaster.cyclecareswindon.co.uk/uploads/1/3/0/2/130271083/soraweveferode.pdf
    • http://nesyb.net/uploads/1/3/0/8/130814393/woxejowedakepa.pdf
    • http://gsliquid.com/uploads/1/3/0/5/130545784/6091129.pdf
    • http://midwesthomebuild.com/uploads/1/3/0/2/130288883/mifipe-kitijodur-gunanexobubotil.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007772.bin
6783df6018ec0fc09d3483328d4822af3f909d14d45c9369399c64eb2ec4f6c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7772 7988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.