Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab779758012b771e…

MALICIOUS

PDF

88.0 KB Created: 2020-05-31 03:49:01 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3c5bc5084dd41c66a62eff8cf0f013e0 SHA-1: 62bbd5976f873650c565965cf7b7ce7ab0783e75 SHA-256: ab779758012b771efc400572a38ff6e7935e31cdaaab367c47249b41778a5618
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document exhibits characteristics of a link farm, containing a large number of external links pointing to various domains. The primary heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, suggesting a coordinated effort to distribute malicious content or engage in SEO manipulation. The embedded URLs likely lead to phishing pages or further malware downloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://baijialechanglongdafa.br3h.com/uploads/1/3/1/3/131378795/131378795.html#discipulado+nueva+vida+en+cristo+volumen+2
    • http://duffingitsmoothly.com/uploads/1/3/1/0/131070829/2310141.pdf
    • http://shopbienfemme.com/uploads/1/3/0/4/130435787/melezol.pdf
    • http://greatlakesherbfaire.com/uploads/1/3/1/3/131379732/7020981.pdf
    • http://viridianair.net/uploads/1/3/0/2/130289738/5417787.pdf
    • http://saysumgood.com/uploads/1/3/0/6/130621279/xemipupiz.pdf
    • http://theroyaltywrx.com/uploads/1/3/0/5/130544781/410613.pdf
    • http://jewelrywithin.com/uploads/1/3/0/7/130776790/borazebenu.pdf
    • http://biblicalbaths.com/uploads/1/3/0/6/130639699/f09a47f80020bf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010da7.bin
fb44b0a4015998351c1c313734d20772882cc226c6d3e170067c98d21c6ef27c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA7 15260 bytes
font_01_sfnt_off00013cb8.bin
8d0e99b9246b1b11cfead2a5b4b43b29ea9de2c4b62407e8e0b02a993056884e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CB8 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.