Malicious PDF — malware analysis report

Static analysis result for SHA-256 a49255a15132a541…

MALICIOUS

PDF

39.7 KB Created: 2020-03-29 05:06:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 49ccc408142af7c8edd88c48252f87da SHA-1: f483981bade6fbf28ae92178954b8bf3289c1d7c SHA-256: a49255a15132a541fb5c79bdd7e505888169f1bb8492bd061d10c761993a7e72
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified as a PDF SEO link farm. The primary URL points to a page with a title related to visual and spatial intelligence, but the document's structure and numerous links suggest a deceptive intent. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, likely intended to drive traffic or host malicious content, rather than provide legitimate information. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bailigongyulechengshoujiban.br3h.com/uploads/1/3/0/8/130814187/130814187.html#que+es+la+inteligencia+visual+y+espacial
    • http://tripowersystems.com/uploads/1/3/0/6/130621000/gezadigomepodi.pdf
    • http://urban-goose.com/uploads/1/3/0/7/130776877/xovan.pdf
    • http://itsseweasy.co.uk/uploads/1/3/0/7/130776644/bikekaforaxezogifapo.pdf
    • http://thepoolguysdm.com/uploads/1/3/0/2/130272862/kikasaxibu.pdf
    • http://fridaynightfoodfight.com/uploads/1/3/0/5/130545043/18c05b.pdf
    • http://azureglowsiberians.com/uploads/1/3/0/7/130775310/306486.pdf
    • http://nfproject.com/uploads/1/3/0/6/130620633/9336577.pdf
    • http://katypoolservice.net/uploads/1/3/0/5/130551179/gatazusuvetavojugas.pdf
    • http://xpresstaxrefund.net/uploads/1/3/0/7/130776037/wojureriguf-rorolinosaj-bizakijera-widafizabowobu.pdf
    • http://mail.reginadelmare.net/uploads/1/3/0/6/130621853/380201.pdf
    • http://mansmellysocks.com/uploads/1/3/0/4/130476412/1ffa9e2558eaf.pdf
    • http://officeprocleaningllc.info/uploads/1/3/0/2/130289540/wofoxadowekidixapivi.pdf
    • http://nuobeijing.devsite-1.com/uploads/1/3/0/6/130621826/wupuja_pewogipita_biruxiwupojexu.pdf
    • http://pavinginportland.com/uploads/1/3/1/3/131398547/kizosetewasojubajise.pdf
    • http://deborahlifestylemaven.com/uploads/1/3/0/3/130313108/6808e8dfe.pdf
    • http://gmprestigefl.com/uploads/1/3/0/2/130288455/6557605.pdf
    • http://www.static.vailhalla.com/uploads/1/3/0/4/130489020/godaki-pojilav-roxudupapo-mujofojukikuwen.pdf
    • http://instrumentrating.net/uploads/1/3/0/7/130776676/tagujanuxijiman-noviped-pakites-joxufowuz.pdf
    • http://www.sdsrenovations.designpreviewer.com/uploads/1/3/0/4/130483134/4da588d7ddeb8.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007316.bin
dceb5d49fb87a7d474180eb4843b859fd1d1bf38144a4043369cbacf2c8dc48c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7316 8200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.