Malicious PDF — malware analysis report

Static analysis result for SHA-256 ae60b2f4d9f00272…

MALICIOUS

PDF

44.4 KB Created: 2020-03-19 04:40:04 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8516b749f8bfe922d06e1616d4112288 SHA-1: 19a7783d1df2e454b6c7e5d2062fb1e2ea60d2d3 SHA-256: ae60b2f4d9f002723beb46d0224b104472cc7d48ceca4634cc1b5c92033c7ead
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body text, while partially corrupted, includes a URL that mirrors one of the embedded links. This suggests the primary purpose is to direct users to a network of websites, likely for SEO spam or to host further malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theleawoodfamilydentist.com/uploads/1/3/0/9/130969938/130969938.html#como+convertir+tabla+en+texto+en+word+2010
    • http://www.goalsoverdreams.com/uploads/1/3/0/5/130539270/9544826.pdf
    • http://www.sharonmoodie.com/uploads/1/3/0/5/130588679/7577809.pdf
    • http://www.innovatewithparadigm.com/uploads/1/3/0/8/130874316/7190104.pdf
    • http://christinareid.net/uploads/1/3/0/7/130739082/vedonemarek.pdf
    • http://gyt-tours.com/uploads/1/3/0/3/130379423/8290077.pdf
    • http://aliciashouse.net/uploads/1/3/0/6/130621134/fa93f45.pdf
    • http://mymarketingpro.net/uploads/1/3/0/7/130740183/dujerononene.pdf
    • http://kelownavacationseasonalrentals.com/uploads/1/3/0/5/130590596/fitevobix.pdf
    • http://mail.thelutherie.com/uploads/1/3/0/5/130538946/e1a90ed.pdf
    • http://nipplereviews.com/uploads/1/3/0/5/130551264/5279947.pdf
    • http://bigtipoftheday.com/uploads/1/3/0/7/130740258/2711678.pdf
    • http://www.jaredfedgerton.com/uploads/1/3/0/6/130605122/6906281.pdf
    • http://marketplacegreen.net/uploads/1/3/0/2/130289292/zonudur.pdf
    • http://www.wellwishescbd.net/uploads/1/3/0/4/130476908/limukeraminod.pdf
    • http://gssurgical.com/uploads/1/3/0/6/130639626/nufoxoz_wewigol.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b75.bin
66067551c8bd1a29ad045fa9da5538d7e073601f990b10aac41209a20818c274		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B75 9784 bytes
font_01_sfnt_off00008ee1.bin
87d8ec319b361bdc22df138228799793f09a7b2e01b8d14427805adcd4a39814		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EE1 16240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.