Malicious PDF — malware analysis report

Static analysis result for SHA-256 b072d600a13359db…

MALICIOUS

PDF

39.4 KB Created: 2020-03-26 07:18:19 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 82c90e796ad63b56fd4969a0527ed62d SHA-1: f081e6d9a17bea29c01d821d3421d59c1873b93f SHA-256: b072d600a13359db4d905c6cfcbb5d0c07694a419e19a131c89448f1ca9ec4d1
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, a technique commonly used to create SEO link farms. The document body, though heavily obfuscated, contains references to URLs such as http://pooch-siclefactory.com/uploads/1/3/0/5/130539129/130539129.html#problemas+de+molalidad+pdf and http://unisourcecleaning.com/uploads/1/3/0/7/130775398/4381696.pdf. These links likely lead to malicious content or further phishing attempts.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pooch-siclefactory.com/uploads/1/3/0/5/130539129/130539129.html#problemas+de+molalidad+pdf
    • http://unisourcecleaning.com/uploads/1/3/0/7/130775398/4381696.pdf
    • http://postmaster.micksniseko.com/uploads/1/3/0/9/130969214/5d9e13a6dd4.pdf
    • http://rskymediallc.com/uploads/1/3/0/3/130323455/gibusoxedugi.pdf
    • http://haroldsgym.net/uploads/1/3/0/4/130477201/gasulutuda.pdf
    • http://lenavillaphoto.com/uploads/1/3/0/6/130604833/tapobalopa.pdf
    • http://socalsupervision.com/uploads/1/3/0/9/130968984/renoveropilu_gafepur.pdf
    • http://operatinglease.gr/uploads/1/3/0/4/130476150/divekirabu.pdf
    • http://thebumpiestpath.com/uploads/1/3/0/5/130540281/3269218.pdf
    • http://mail.wollf�hlen.ch/uploads/1/3/0/4/130492315/pofaro.pdf
    • http://wetproposalapparel.com/uploads/1/3/0/6/130604864/tevewipezo-godunarusa-xonakokepazivu-kuziradimege.pdf
    • http://blastmasterstn.com/uploads/1/3/0/7/130739022/8783c702fc5.pdf
    • http://456fillmore.com/uploads/1/3/0/2/130270993/a526e.pdf
    • http://theharwichclipper.com/uploads/1/3/0/4/130476722/genanuwita.pdf
    • http://dancetodaybiz.com/uploads/1/3/0/6/130604541/lalinujirolar.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006370.bin
ed5050675d5f38d0dd1c062e996f522143ce3d657748a127c9344c3366fb1d37		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6370 8968 bytes
font_01_sfnt_off00008416.bin
0d2879dbb3ca49bcbf37fc4e85455390636a45f20b17498b37af517046576925		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8416 2880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.