Malicious PDF — malware analysis report

Static analysis result for SHA-256 a0c228b5201c2eeb…

MALICIOUS

PDF

41.3 KB Created: 2020-03-29 13:08:12 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: ff33c36409c793805b752ce1fe9360b8 SHA-1: d38d127af399bc7627f92b040d62ffeb53ee7a92 SHA-256: a0c228b5201c2eeba10194e61946593231281d3aef73898e43f924f627979901
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique commonly used for SEO spam or to distribute malicious content. The document body, though partially corrupted, suggests a lure related to academic or professional writing. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this is part of a link farm designed to manipulate search engine results or direct users to potentially harmful sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://webdisk.collegedemsatiu.com/uploads/1/3/0/4/130488968/130488968.html#como+redactar+una+hipotesis+de+trabajo
    • http://iamcompany.net/uploads/1/3/0/7/130775174/7e57b07fc.pdf
    • http://paulwruckconstructions.com/uploads/1/3/0/8/130874016/7350831.pdf
    • http://cothrons.net/uploads/1/3/0/6/130621980/0edc82.pdf
    • http://stateoftheblackdollar.net/uploads/1/3/0/7/130776148/9645036.pdf
    • http://foodiefia.com/uploads/1/3/0/9/130969476/4544198.pdf
    • http://captainronsbugspray.com/uploads/1/3/1/3/131384414/moleguzabigatud.pdf
    • http://tol-taiwan.org/uploads/1/3/0/3/130323894/9514208.pdf
    • http://staceyvulakh.com/uploads/1/3/0/6/130604772/4498119.pdf
    • http://runnersofthenish.com/uploads/1/3/0/3/130379634/zejutoximigune.pdf
    • http://ladavisbooks.com/uploads/1/3/1/4/131437813/fawirodumiva.pdf
    • http://kemcutisekolah.net/uploads/1/3/0/6/130639054/4188328.pdf
    • http://womenheartofwestdenver.com/uploads/1/3/0/2/130272361/bovimivevifu.pdf
    • http://licktypic.com/uploads/1/3/0/3/130323374/828121.pdf
    • http://gweiloandgora.com/uploads/1/3/0/5/130545421/venigenoj-buwonexoxu-lanibuga.pdf
    • http://columbusliceremoval.com/uploads/1/3/0/9/130969004/wowigatasa.pdf
    • http://qodin.com/uploads/1/3/0/2/130288562/5084279.pdf
    • http://annadjohnson.com/uploads/1/3/0/5/130538949/natobafopu.pdf
    • http://freshwaterscouts.com/uploads/1/3/0/5/130588435/1ce7084.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007844.bin
e16c19f024cf6a6dbb697bbc23f8908a967b3588ddd245f12bb2f4879791862d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7844 8136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.