Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad2176f5b764cfd9…

MALICIOUS

PDF

51.2 KB Created: 2020-03-08 09:46:42 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4863061bd0399705317c447d89c3f3b2 SHA-1: 2a33f2ffa7427b52fc10377ebf0d12fe8284069e SHA-256: ad2176f5b764cfd9f36fea5a31d621a758699ca97bdf7de6a43e03adf22f399b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are SEO-optimized and point to PDF files on various domains. This technique is often used to distribute malicious content or redirect users to phishing sites. The presence of a link farm heuristic strongly suggests this is the primary malicious function. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/2/130288643/130288643.html#autoimmune+hepatitis+aasld+guidelines+2017
    • http://www.bluesteelradio.com/uploads/1/3/0/6/130604025/6700506.pdf
    • http://www.voiceoveranna.com/uploads/1/3/0/5/130539114/3276452.pdf
    • http://ecotherapyspirituallounge.com/uploads/1/3/0/3/130380037/susibigoruvesumigi.pdf
    • http://www.newlifedestination.com/uploads/1/3/0/9/130969991/2547349.pdf
    • http://www.richmondcoworking.com/uploads/1/3/0/6/130639559/4273001.pdf
    • http://neuface.net/uploads/1/3/0/2/130271045/fobejasepuwabovotemi.pdf
    • http://www.rachelunbound.com/uploads/1/3/0/5/130544826/1699312.pdf
    • http://homeintergration.com/uploads/1/3/0/9/130969658/eb73c53f35.pdf
    • http://josephina.ballerina.com/uploads/1/3/0/5/130539059/dexenosidavuvinuvuw.pdf
    • http://www.dellxl.org/uploads/1/3/0/4/130483354/fa322a.pdf
    • http://sanjosedelosreynoso.com/uploads/1/3/0/2/130272242/4208756.pdf
    • http://djsacademy.com/uploads/1/3/0/6/130640072/xakivabovazojubon.pdf
    • http://gabrielkane.com/uploads/1/3/0/8/130813818/4668728.pdf
    • http://optimusbusiness.net/uploads/1/3/0/7/130776687/7f7e0242a4af8.pdf
    • http://shop.missabellahousekeeping.com/uploads/1/3/0/2/130287930/dumesezema_lukitabivifun_razuzorod.pdf
    • http://www.osborgoflove.com/uploads/1/3/0/2/130287269/301bf73b30.pdf
    • http://www.fdceducatorsnsw.com/uploads/1/3/0/2/130272973/rikonarinofezed.pdf
    • http://indigorealms.com/uploads/1/3/0/6/130639183/d9dd99d010.pdf
    • http://naturesedge-fl.org/uploads/1/3/0/5/130540604/0961d3a5d.pdf
    • http://mta-sts.mail2.hauntedhousetour.com/uploads/1/3/0/3/130379431/galatedozodezij-wekibed-nibeliv.pdf
    • http://anastasiaosho.com/uploads/1/3/0/6/130639842/zutelitonaduxod.pdf
    • http://georgwebbtogo.com/uploads/1/3/0/6/130620961/2cf4642d.pdf
    • http://steveslawnmowersales.com/uploads/1/3/0/3/130313037/667dae955ffa.pdf
    • http://grovetennislessons.com/uploads/1/3/0/5/130550800/pejoli.pdf
    • http://palletwrapz.net/uploads/1/3/0/4/130494636/magopewinof.pdf
    • http://steveslawnmowersales.com/uploads/1/3/0/3/130313037/667dae955f
    • https://doi.org/10.1002/hep.31065
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009983.bin
c568828af4764a1920f8a472a096c083ad3f30976752f902a5b046375e0350fc
pdf-font-stream PDF embedded font (sfnt) at offset 0x9983 10284 bytes