Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1a18267363d0704…

MALICIOUS

PDF

56.3 KB Created: 2020-03-27 04:12:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 861e69e70c3305b6af473a5bed0ac64c SHA-1: 6d6e691980358735bd2c6ad9d20235e32422963d SHA-256: b1a18267363d070432f6c01bdbd0c4b09aa4a28e351b327e3a319b5135397aa0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for other malicious content. The document body itself contains some of these URLs, indicating a deliberate attempt to direct users to external resources. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://iweargreatness.com/uploads/1/3/0/6/130639199/130639199.html#relaciones+intraespec%C3%ADficas+familiares+hacen+referencia
    • http://bridgettewolleat.com/uploads/1/3/0/6/130620709/supulixem.pdf
    • http://pkdstudygroup.com/uploads/1/3/1/0/131070216/zivan.pdf
    • http://www.unicorns-are-vegan.com/uploads/1/3/0/9/130969305/9255993.pdf
    • http://penickfarms.org/uploads/1/3/0/5/130589402/bemevudej.pdf
    • http://selimmawad.com/uploads/1/3/0/4/130483690/vupakom-wujenewovod.pdf
    • http://mattyryan.us/uploads/1/3/0/5/130590545/3acdf686.pdf
    • http://www.oubliercorp.ca/uploads/1/3/0/8/130874670/pojixawav.pdf
    • http://fairwindsmarina.net/uploads/1/3/0/4/130488241/voxelizam_nuropesuleg_zetoza.pdf
    • http://servicepartnervanderveenassen.nl/uploads/1/3/0/6/130604841/8563055.pdf
    • http://www.nnausaconvention.com/uploads/1/3/0/7/130739006/015ec9.pdf
    • http://www.microhavens.com/uploads/1/3/0/4/130476010/4fe8403ce8.pdf
    • http://nydommes.com/uploads/1/3/0/5/130551325/7746332.pdf
    • http://jameshamiltonroofingandbuilding.com/uploads/1/3/0/7/130776692/c9dda6c942138db.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ae7d.bin
0b8539d8266383f8bb9b3965297e9d443be72385bfe7f889448f77f5f62b301e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE7D 9668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.