Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad7de331f0cf3967…

MALICIOUS

PDF

42.7 KB Created: 2020-03-29 12:56:54 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 61693233c93fb3ebb7e9f3e44c5f6c04 SHA-1: a264c43442287b1ce5219233c9273e154340e2e9 SHA-256: ad7de331f0cf3967c9736061f72d7c575d666c528cd0561cb82a4705f2c6195d
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links to other PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, suggesting the primary purpose is to manipulate search engine results or to act as a distribution point for further malicious content. The document body contains garbled text and metadata related to its creation, but the core malicious activity is driven by the embedded URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lennoxweb.com/uploads/1/3/0/5/130551433/130551433.html#menor+o+igual+en+word
    • http://dallaspatioguy.com/uploads/1/3/0/7/130740340/gubifazir_digegux_donefeluxor.pdf
    • http://aufuturclothing.com/uploads/1/3/0/9/130969926/555828.pdf
    • http://thebankhotel.org/uploads/1/3/0/5/130551125/negodosiduxasituj.pdf
    • http://angelsplacecafe.com/uploads/1/3/0/7/130739405/kugev-rutewo.pdf
    • http://skaramuss.com/uploads/1/3/0/7/130738697/4f3d0a03e.pdf
    • http://middlechildclothing.com/uploads/1/3/0/7/130740046/mipapupuf.pdf
    • http://odbny.com/uploads/1/3/0/6/130621000/lizikajilomoluxo.pdf
    • http://fatherflow.com/uploads/1/3/0/6/130620644/xubilazug_ketine.pdf
    • http://emilyconvers.com/uploads/1/3/0/3/130379110/kebakelapasukutumifa.pdf
    • http://keepitgreenlandscape.com/uploads/1/3/0/2/130288562/38806aab.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000062da.bin
5fd1873fd702b1a1160abaf048b24c8117471fa823a4739d4ea29a24d25fd6ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x62DA 9932 bytes
font_01_sfnt_off000086b9.bin
8c20e5a40599f8f27a739ba937f6a38d8b78f10512dd1d099c928abf7f550bb4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86B9 16592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.