Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8e65d229553c7c6…

MALICIOUS

PDF

37.8 KB Created: 2020-05-22 05:43:45 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3bfd63ce6dc6046e293ac707cdad34bd SHA-1: f534ff8757031c1ff391bc54deb5634689b212a1 SHA-256: a8e65d229553c7c676d6bcb03dd7eb1275cc18197b39568106d621406096726c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files hosted on various domains. This suggests a link farm or a method to distribute malicious content indirectly. The document body contains text related to 'Mario and Luigi Superstar Saga rom u', indicating a lure for users searching for game ROMs. No scripts were extracted from this sample. The primary attack pattern involves enticing users to click through a series of links, potentially leading to malware downloads or phishing sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lameeplaceholder.devsite-1.com/uploads/1/3/0/2/130271061/130271061.html#mario+and+luigi+superstar+saga+rom+u
    • http://oldguardtees.com/uploads/1/3/1/8/131857060/nukowasut_miluf.pdf
    • http://ns1.mitasbakeshop.com/uploads/1/3/1/1/131164250/9476287.pdf
    • http://thecakebyceci.com/uploads/1/3/0/6/130604259/01b864b3.pdf
    • http://2017giants.com/uploads/1/3/1/4/131407736/0d1c4f4608f79.pdf
    • http://alternativehmg.com/uploads/1/3/1/3/131383678/popawiku-ketit.pdf
    • http://apexbookings.com/uploads/1/3/0/6/130620370/jipowumavike_falosoruwugax_vivomerodun_gitowufibetoza.pdf
    • http://kokoonmi.fr/uploads/1/3/0/7/130740017/2477953.pdf
    • http://winkelitemink.com/uploads/1/3/1/4/131454620/8228eaf.pdf
    • http://cariboustrategies.com/uploads/1/3/1/6/131606624/6bb36eeb.pdf
    • http://onecrazyraven.com/uploads/1/3/0/4/130476605/df927607de838b.pdf
    • http://diegojones.com/uploads/1/3/0/6/130621076/mapowasolulava.pdf
    • http://affectivedevelopment.com/uploads/1/3/0/5/130588492/reluxojil.pdf
    • http://vildtgaarden.com/uploads/1/3/0/6/130604771/zulafime_muparirupapo.pdf
    • http://elevatedadventures.com/uploads/1/3/1/6/131606073/4ea24.pdf
    • http://flcboutique.shop/uploads/1/3/1/3/131379830/3489006.pdf
    • http://greenhillwinery.info/uploads/1/3/0/4/130436154/4336595.pdf
    • http://tennisinbusiness.org/uploads/1/3/0/4/130490602/93017d55.pdf
    • http://nubianessencellc.com/uploads/1/3/1/3/131398157/1151122.pdf
    • http://fhssoftball.com/uploads/1/3/1/3/131379899/kigojo.pdf
    • http://doulainhudsonvalleynewyork.com/uploads/1/3/0/6/130604238/2ffca24323f0d.pdf
    • http://dokkarise.com/uploads/1/3/0/6/130621865/rapunevedub-mopusoxapu.pdf
    • http://sonicrepair.com/uploads/1/3/0/6/130604180/buzela.pdf
    • http://heartrates.net/uploads/1/3/1/6/131636957/9395457.pdf
    • http://duskcollaborative.org/uploads/1/3/0/6/130604612/1e3ef003.pdf
    • http://wlmproperties.net/uploads/1/3/0/7/130740427/zodufotesok-zimugemuvadod-tibadopolobetig.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006433.bin
9751cac95224657f6ae6e35c46bbc65ed2fa607b96b3f256b85756eeec3f26db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6433 12192 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.