Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7e43bb687963e45…

MALICIOUS

PDF

40.3 KB Created: 2020-04-02 08:44:14 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5b45892d05109edf28f75380a069f598 SHA-1: d0d3a9846481d5737ebf1b0754718f060ba4cad5 SHA-256: a7e43bb687963e454edb2b1e22ada3d74734592d2afab960c496fbd211fce5ec
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body text, though partially corrupted, suggests a lure related to 'Pattern worksheets for kindergarten'. The primary purpose appears to be to direct users to a link farm, likely for SEO manipulation or to host further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://morethanjustaface.nl/uploads/1/3/1/4/131454089/131454089.html#pattern+worksheets+for+kindergarten
    • http://ellcclub.com/uploads/1/3/0/7/130775166/2b3e1a7cfc.pdf
    • http://chicagocamogie.com/uploads/1/3/1/0/131070192/nodebogomelo-rulot-mivigabebo-gutoradejexe.pdf
    • http://utopianremodel.com/uploads/1/3/0/7/130775589/tevaxasi-napevubab-jogetana-vetoxuge.pdf
    • http://tiffanyfoster.ca/uploads/1/3/0/6/130639539/1c27c9f780837.pdf
    • http://youthgrace.org/uploads/1/3/0/5/130589402/7531494.pdf
    • http://printerpie.net/uploads/1/3/0/2/130287269/8834957.pdf
    • http://mavenmagz.com/uploads/1/3/0/6/130604348/relaz_nesulifo_vixamololepu.pdf
    • http://sellnanashouse.com/uploads/1/3/0/2/130289524/nifuteworega-luluwi.pdf
    • http://eoehandbook.com/uploads/1/3/0/2/130288341/ba9683cdbe0088a.pdf
    • http://michaelcustomdesign.com/uploads/1/3/0/9/130969545/6526223.pdf
    • http://calebsbrain.com/uploads/1/3/1/3/131384714/zopexofopulubi-tugevefu.pdf
    • http://lisamason.ca/uploads/1/3/0/5/130550714/fuguwesuk_jojejixepu_gafoguneximewi_pefabasop.pdf
    • http://spikek9.com/uploads/1/3/0/3/130323811/8007034.pdf
    • http://229refinery.com/uploads/1/3/1/3/131380251/3b94082ad39.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000075e3.bin
f537c271e0bcbd84e77756a9c9e3b4af13a5d8e96b019265a18a9197f21a2cca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x75E3 7644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.