Malicious PDF — malware analysis report

Static analysis result for SHA-256 a469d65783b3bcf3…

MALICIOUS

PDF

36.8 KB Created: 2020-04-12 13:58:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5937034d6fa3a99067f7059373920e7a SHA-1: 295be4800975fe62f381e27b010cfc9b8d1c4335 SHA-256: a469d65783b3bcf3d62297c9882ca00ae7323fab871cc85c88406d726584f80d
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links pointing to various domains, indicating a link farm or SEO spamming operation. The primary heuristic firing confirms this, identifying a mass external PDF link farm. The embedded URL also points to a similar structure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vinculum.info/uploads/1/3/1/6/131637649/131637649.html#stroke+volume+depends+on+preload+afterload+and+which+of+the+following
    • http://healthscoot.com/uploads/1/3/0/8/130873976/5e61639cd7d446.pdf
    • http://edreypoolrepairs.org/uploads/1/3/0/7/130776518/48ed549c39.pdf
    • http://drclogistics.net/uploads/1/3/0/4/130435654/92c7bab6f2.pdf
    • http://binnachcharacters.com/uploads/1/3/0/9/130969926/4447728.pdf
    • http://kafexpress.com/uploads/1/3/1/4/131437064/df939055.pdf
    • http://visitsos.com/uploads/1/3/0/9/130969315/jamamof-fagukewi-dadut.pdf
    • http://pourhousetavern.net/uploads/1/3/0/8/130813904/ravukiwizokituja.pdf
    • http://lovinghartquits.com/uploads/1/3/0/8/130813956/woreniw_fodapufune_xetewiz_zuzolevevimo.pdf
    • http://loganbriendesign.com/uploads/1/3/1/3/131379544/kesulirosod.pdf
    • http://enchantedgoddess.net/uploads/1/3/1/4/131453299/5199493.pdf
    • http://topgunfinancialservices.com/uploads/1/3/0/6/130620646/zasedag-jobilakuxojo-nagaxiginur.pdf
    • http://hmelectricllc.com/uploads/1/3/0/5/130551433/4805408.pdf
    • http://4100expressave.com/uploads/1/3/0/4/130488543/4860955.pdf
    • http://everydaychristianity.org/uploads/1/3/0/7/130776078/8bfe0c24.pdf
    • http://4100expressave.com/up
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000698d.bin
209e77329f67cec263366da1c58006ef8135f8e90e1def4dc43192857ab73949		 pdf-font-stream PDF embedded font (sfnt) at offset 0x698D 7344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.