Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1bd69f5c1a13fbb…

MALICIOUS

PDF

55.4 KB Created: 2020-03-20 12:28:58 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 409341b281278e8296fd0e95979f5611 SHA-1: 8e7245c30f506526b93644d191ef7e75444d9b0f SHA-256: b1bd69f5c1a13fbbf726796a14d7c133525bf4fe1c66f0eae95183cd71880455
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similar domains. This pattern is indicative of a link farm designed to artificially inflate search engine rankings or to distribute malicious content. The presence of the URL 'http://65bancker.com/uploads/1/3/0/8/130813420/130813420.html#descargar+cancion+salvame+rbd+mp3+gratis' suggests a lure for users searching for specific content, which then redirects to a network of potentially harmful files.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://65bancker.com/uploads/1/3/0/8/130813420/130813420.html#descargar+cancion+salvame+rbd+mp3+gratis
    • http://motionfuels-arkansas.com/uploads/1/3/0/5/130590054/mukemexunizupape.pdf
    • http://zhangxiaoyan.info/uploads/1/3/0/8/130813731/db4986ec.pdf
    • http://fancyflushrestrooms.com/uploads/1/3/0/5/130590779/sulisagovaketitumem.pdf
    • http://omnichill.org/uploads/1/3/0/5/130551418/dexigi.pdf
    • http://astwoodinvestments.com/uploads/1/3/0/6/130605393/3334843.pdf
    • http://indybrands.com/uploads/1/3/0/6/130639982/499740.pdf
    • http://slat.website/uploads/1/3/0/3/130313649/lesejedasesupi-bitebezi-boluz.pdf
    • http://kizargraphics.com/uploads/1/3/0/6/130639591/56cd543963.pdf
    • http://www.catholiccompass.net/uploads/1/3/0/6/130621596/mimunodufobeful.pdf
    • http://nastybritches.com/uploads/1/3/0/5/130545278/defogusoza-bogagoxarajuke-wavigebanod-bobuzoze.pdf
    • http://mail.chirogust.be/uploads/1/3/0/2/130274319/4869581.pdf
    • http://gnaeusltd.com/uploads/1/3/0/6/130620633/mezevijutomafiz-bozokumit-bolatupib-kajonobazoza.pdf
    • http://labriciola.com.do/uploads/1/3/0/8/130813829/86351d15b.pdf
    • http://happytimes-cdc.com/uploads/1/3/0/2/130271046/2174889afb70.pdf
    • http://placegram.net/uploads/1/3/0/7/130739695/7956280.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006b60.bin
963efec7bb24f8c73ee4f0846f8b51a12ee7ff9e532c8f1364a5c0ff35f23be7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B60 9520 bytes
font_01_sfnt_off00008d74.bin
5e0a6a1f76f43de472d0836d533abd7347f2b85d8cc7ebd0a2fc0845419e5f7a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8D74 10240 bytes
font_02_sfnt_off0000ae59.bin
8ec8c2252d1b0a1cc16637c0e1f77da7137146423e231c53be47bbaf832064ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE59 2048 bytes
font_03_sfnt_off0000b7fd.bin
bb7f3a77f7833b39fe6b0cf08265a5ad0460cb4bda91382e6c877c0db3ce514d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB7FD 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.