Malicious PDF — malware analysis report

Static analysis result for SHA-256 a33fab846358f815…

MALICIOUS

PDF

67.1 KB Created: 2020-03-18 13:12:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 712fd1b62b5136ab980403f3f3782b83 SHA-1: f24cfe5658123325dc25364763f06a6f05cd8e19 SHA-256: a33fab846358f815526098c19d8761b105b2ed0e6f0e61ec5ee2296d45ae6434
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a method to distribute malicious content across multiple sites. The document body contains garbled text and a reference to 'economia normativa', which appears to be a lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nashobavalleyextractco.com/uploads/1/3/0/5/130590191/130590191.html#definicion+corta+de+economia+normativa
    • http://mta-sts.tinaweldy.org/uploads/1/3/0/4/130483413/74bca26c8ff96a0.pdf
    • http://potsandpets.com/uploads/1/3/0/6/130605218/144484.pdf
    • http://www.mybusinesspromoter.it/uploads/1/3/1/0/131070588/8ad655af95.pdf
    • http://vinylisheavy.com/uploads/1/3/0/9/130969003/simubasopefumonexuna.pdf
    • http://www.affordableluxurydesignersshoppe.com/uploads/1/3/0/8/130873880/6767110.pdf
    • http://decolonization-repatriation.com/uploads/1/3/0/4/130435791/e0b25324118ee1c.pdf
    • http://welshfiresprinklers.com/uploads/1/3/0/7/130738658/6751175.pdf
    • http://cdn-2.artisticvegan.com/uploads/1/3/0/2/130289729/1cd2362811f08.pdf
    • http://camarederieltd.org/uploads/1/3/0/2/130289564/4253943.pdf
    • http://dbdclothing.com/uploads/1/3/0/5/130543764/kekulakejewodawite.pdf
    • http://googlyeyeschallenge.com/uploads/1/3/0/5/130539074/zufunazeju.pdf
    • http://susiestreats.com/uploads/1/3/0/6/130639231/lezujoferuxodu-nawuberebisajit.pdf
    • http://weruntheforest.co.nz/uploads/1/3/0/5/130551770/tazaraki.pdf
    • http://nittygrittydetailing.com/uploads/1/3/0/7/130740250/ff0db845.pdf
    • http://paleofoot.com/uploads/1/3/0/5/130547552/wunufikoj.pdf
    • http://mrkrieg.com/uploads/1/3/0/6/130621651/40549214818dd0.pdf
    • http://webmail.benjaminburch.com/uploads/1/3/0/2/130291874/jisovasoledixa-fufefepilug.pdf
    • http://glowbearcare.com/uploads/1/3/0/8/130813553/02b931ce6.pdf
    • http://lenka-photography.com/uploads/1/3/0/5/130589122/titojadarogine.pdf
    • http://oneaday.dance/uploads/1/3/0/2/130273842/2244915.pdf
    • http://gdpestcontrolservices.co.uk/uploads/1/3/0/8/130813658/sigalupewitowim.pdf
    • http://bobthust.net/uploads/1/3/0/4/130483733/tizevujifinopur-maxovojasego-ruvite.pdf
    • http://universityanesthesiology.com/uploads/1/3/0/4/130483961/77c769e5ad024d4.pdf
    • http://ambersartistryphotography.com/uploads/1/3/0/3/130379457/ac48e01fe9ccac.pdf
    • http://www.philipfmessina.com/uploads/1/3/0/7/130738657/kujorarubowaxe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b6fc.bin
4b2751324eb68497f41421174f82b686d10e1b109eab649a699009b6676d7e0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB6FC 9360 bytes
font_01_sfnt_off0000d8d8.bin
ffeeaf3acf1cbbf6e41d21fa4748a9afddbd52efb51ca1edf3e2d256b9dad2b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD8D8 3704 bytes
font_02_sfnt_off0000e551.bin
ea40dc10595cbd0e0d8367a6e9e31f071a73dc387445f809eb5200acbf800819		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE551 16388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.