Malicious PDF — malware analysis report

Static analysis result for SHA-256 aad647e66fa02c59…

MALICIOUS

PDF

73.8 KB Created: 2020-03-26 02:13:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 84c060510655b2faacc84e3199db3359 SHA-1: 59911808e86936d75112f701367d5a2ede2fa989 SHA-256: aad647e66fa02c59b14db6aa695f862d066a47eb8c81f50919ee6c2bb6f84411
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or SEO manipulation tactic. The primary heuristic 'PDF_SEO_LINK_FARM' confirms this behavior, with 30 external PDF links identified. The document body, though partially corrupted, contains the text 'Viscosidad de la sangre' and metadata suggesting it was generated by wkhtmltopdf, a tool often used to create PDFs from web content. The presence of numerous unknown-reputation URLs suggests a distribution or redirection mechanism.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ndchair.com/uploads/1/3/0/7/130740572/130740572.html#viscosidad+de+la+sangre
    • http://alexiszotos.com/uploads/1/3/0/2/130288462/b49e078eb.pdf
    • http://mail.strengthindia.org/uploads/1/3/0/2/130274267/tirata-wedenoreninal-jovusubux.pdf
    • http://bradypearls.com/uploads/1/3/0/6/130639911/muxigujiwafo.pdf
    • http://crosstowndistributing.com/uploads/1/3/0/8/130873894/7715891.pdf
    • http://clearbrookorchestra.org/uploads/1/3/0/8/130874559/9724732.pdf
    • http://slumberingsouls.com/uploads/1/3/0/4/130490876/piragumabemamusokux.pdf
    • http://my-revision.com/uploads/1/3/0/5/130541443/8068185.pdf
    • http://www.bricklegends.com/uploads/1/3/0/6/130620708/2179590.pdf
    • http://topshamfinearts.com/uploads/1/3/0/7/130775166/bixigefi.pdf
    • http://ccsps.info/uploads/1/3/0/5/130551342/taxuvedi.pdf
    • http://lynefit.com/uploads/1/3/0/6/130640164/lunudebumozafu.pdf
    • http://thebarn-mo.org/uploads/1/3/0/2/130287318/pakixodurugujus-mudapitananod-fekegufogaja.pdf
    • http://wiseguysav.com/uploads/1/3/0/6/130620536/xipomodi-pujigudalevu.pdf
    • http://indirectsupplychain.com/uploads/1/3/0/7/130738956/5391402.pdf
    • http://englishtheory.net/uploads/1/3/0/6/130604551/nesiwobu-jigokakosa-berupexifitepak-wupulafi.pdf
    • http://mikeintucson.com/uploads/1/3/0/6/130640010/punalipulelanajo.pdf
    • http://crowandbetty.com/uploads/1/3/0/8/130874318/neripofapeguzogu.pdf
    • http://cdn.artisticvegan.com/uploads/1/3/0/4/130488486/4679118.pdf
    • http://4streets.org/uploads/1/3/0/5/130541743/bedisolab.pdf
    • http://lazyattack.net/uploads/1/3/0/5/130590371/433698.pdf
    • http://www.janecrosscreative.com/uploads/1/3/0/6/130604615/sezegojimeruw-logoxewexokuj-gokix.pdf
    • http://menedzer.website/uploads/1/3/0/6/130620372/2833139.pdf
    • http://hta2.com/uploads/1/3/0/7/130775657/vijax_rawategumapu_xebatamedeforo_remap.pdf
    • http://kirbymuxloewindows.com/uploads/1/3/0/4/130435982/227f380bba12.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000cfc4.bin
bbe04edcf42bf83261f6b4679e88cd414e088c952a4b3e808900db59455a3f8b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCFC4 9912 bytes
font_01_sfnt_off0000f37f.bin
d1b32da7567565f9659896339764c6488b45529fdbc353b33a8b07ef0e778f44		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF37F 4036 bytes
font_02_sfnt_off00010165.bin
6842a8d4b9e82b8991376d0d1627a80f8590f49aa779de275bd1c0cecc0ee774		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10165 16176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.