Malicious PDF — malware analysis report

Static analysis result for SHA-256 aed0caf501253b89…

MALICIOUS

PDF

53.1 KB Created: 2020-04-09 04:29:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 83da7f86ce3036c0e6e56241836f7dbe SHA-1: b0221950920cedc1cec86e411007a515833459f7 SHA-256: aed0caf501253b895a79d79c37c653edbf1ab0192ea1cb12856ad84fbe112262
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or SEO manipulation tactic. The embedded document body text, though partially corrupted, includes a URL that mirrors one of the identified external links. No scripts were extracted from this sample. The primary attack pattern involves directing users to a multitude of external resources.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://klokkeraadgivning.com/uploads/1/3/0/6/130604672/130604672.html#the+human+stain+philip+roth
    • http://annedykers.com/uploads/1/3/1/3/131383424/43932151835.pdf
    • http://leadingchristianity.com/uploads/1/3/1/3/131379221/vumazigiwikojewifor.pdf
    • http://palomarodrigues.com/uploads/1/3/0/8/130815080/siboforigu.pdf
    • http://americanyardscapes.com/uploads/1/3/0/6/130639939/31dcbf7c43e3.pdf
    • http://jl-imagery.com/uploads/1/3/0/5/130551526/fapunokefokasew.pdf
    • http://bughunters.eu/uploads/1/3/0/5/130543070/dosoweku-pagivupulit.pdf
    • http://djjonathanmihellis.com/uploads/1/3/0/5/130588597/polafegef.pdf
    • http://lifeoflani.com/uploads/1/3/0/4/130483510/3d425d.pdf
    • http://thirdchevron.com/uploads/1/3/1/0/131070481/57cca5491293d7a.pdf
    • http://teresasmusz.com/uploads/1/3/0/6/130604812/gokibelipitomaduvebi.pdf
    • http://pagamentos.org/uploads/1/3/1/4/131483118/f75a443.pdf
    • http://jenahartley.com/uploads/1/3/0/2/130288318/5644658.pdf
    • http://94veinte.com/uploads/1/3/1/0/131069840/4889100.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009d93.bin
2e9bcc6ef514554f0c0382d2c344b21cc131cab68e658b17be7b2992f1dae522		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9D93 8544 bytes
font_01_sfnt_off0000be28.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xBE28 2596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.