Malicious PDF — malware analysis report

Static analysis result for SHA-256 a98a86d38a439e60…

MALICIOUS

PDF

45.6 KB Created: 2020-04-02 00:35:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: fef03abd838a7208e3a5400d02c5c0f2 SHA-1: c5f7225e9ce48fc4fe34f08ffa56440f1c14ae4e SHA-256: a98a86d38a439e6023328c7cc1d93a72989e8a61f8ecd93f6d75b1988a86d0d5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to PDF files with numeric slugs, indicative of a link farm or SEO spam tactic. The document body itself contains a question about a Free.fr phone number, which is likely a lure to encourage clicks on the embedded malicious URLs. The primary intent appears to be directing users to potentially malicious websites through these links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://slbconsultingservices.com/uploads/1/3/0/6/130640163/130640163.html#quel+est+le+num%C3%A9ro+de+t%C3%A9l%C3%A9phone+de+la+messagerie+free+%3F
    • http://customartpresentation.com/uploads/1/3/0/4/130490719/ee818.pdf
    • http://anotherhunnygoddessproduction.com/uploads/1/3/0/4/130476308/dosigetewori.pdf
    • http://selfloveinplainsight.com/uploads/1/3/0/5/130543979/zibenupobubavilu.pdf
    • http://kaylasuzanne.org/uploads/1/3/0/5/130551526/1380459.pdf
    • http://kristinerinartistry.com/uploads/1/3/0/5/130588307/5935773.pdf
    • http://katolivares13.com/uploads/1/3/0/4/130477372/wobof.pdf
    • http://ashevillecarpetcleaning.org/uploads/1/3/0/5/130545643/semefud.pdf
    • http://picklesedinburgh.com/uploads/1/3/0/5/130538997/408952.pdf
    • http://nexustempe.com/uploads/1/3/0/5/130543064/zuwikuwimirijujonuno.pdf
    • http://mixmax.biz/uploads/1/3/0/8/130814024/be3dd9909f0.pdf
    • http://woodbridgenjplumbers.com/uploads/1/3/0/4/130436204/8949820.pdf
    • http://metamixis.com/uploads/1/3/0/7/130775388/gotetibufefum.pdf
    • http://majesticpleasantprairie.com/uploads/1/3/0/7/130739607/742edbfe.pdf
    • http://listen2alexza.com/uploads/1/3/0/6/130622029/sukuwupumanunijojob.pdf
    • http://santosmillworkcorp.net/uploads/1/3/0/5/130589299/retarefa-vigoperel.pdf
    • http://uptownrusticms.com/uploads/1/3/1/3/131383647/8878984.pdf
    • http://theshoutstorytelling.com/uploads/1/3/0/6/130639960/xamakat.pdf
    • http://ikankawan.org/uploads/1/3/0/8/130813111/wutujiditigakal.pdf
    • http://peaceofgloryfounation.com/uploads/1/3/0/7/130738564/7beb03b67844.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000822a.bin
a3faa3a91f00659b4cfcf509d8af013cce2e0609de4f719ca6eca71504d13d25		 pdf-font-stream PDF embedded font (sfnt) at offset 0x822A 10068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.