Malicious PDF — malware analysis report

Static analysis result for SHA-256 b46df35016dcc9ab…

MALICIOUS

PDF

49.4 KB Created: 2020-04-05 05:42:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 59ed8dffcc47b09be725ec437cacfa36 SHA-1: 326c1eca51c06e6ce959cf2294bee61c5461fe39 SHA-256: b46df35016dcc9ab5fad43bc039ff08c74cff954ee076df708fca25b3bdd529b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to similarly structured URLs on different domains. This pattern is indicative of a link farm or SEO abuse, likely intended to drive traffic or host malicious content. The document body itself is largely obfuscated but contains a reference to 'how to sync hmdx jam speaker', which may be a lure. No scripts were extracted, and the primary malicious activity appears to be the distribution of these numerous external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thehnossaproject.com/uploads/1/3/0/2/130289585/130289585.html#how+to+sync+hmdx+jam+speaker
    • http://seliasomething.com/uploads/1/3/1/1/131163760/gogatu_pefarabovet_narusuxexipu_pifujiv.pdf
    • http://cupertinoflorist.store/uploads/1/3/0/6/130620604/79db9d97e2383bd.pdf
    • http://indycornmaze.com/uploads/1/3/0/4/130477613/e7ac922.pdf
    • http://farnorthqldsporting.org/uploads/1/3/1/0/131069870/2712637.pdf
    • http://shoppedit.com/uploads/1/3/0/5/130550777/tedenafamenupejubuze.pdf
    • http://dan3finneylaw.com/uploads/1/3/1/0/131070689/vifexezifu.pdf
    • http://luferreiraproducoes.com/uploads/1/3/0/9/130969316/5665281.pdf
    • http://dig-in-denver.com/uploads/1/3/1/3/131384402/2018530.pdf
    • http://countyturfpro.com/uploads/1/3/0/6/130603753/demer-begajod-xiwutofuz.pdf
    • http://lynnewrightvirtualpa.com/uploads/1/3/0/2/130272372/d48609b4.pdf
    • http://journeylaurel.net/uploads/1/3/0/7/130739387/jejilabalixo.pdf
    • http://maddiebriggs.com/uploads/1/3/0/7/130740558/bomasus.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006495.bin
463eef1bdfefad3ad6ddef9a1f9d82eddae4b5f025ee48734b13d12a115f863b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6495 8352 bytes
font_01_sfnt_off000083f4.bin
4c93801c4768b9cf34ec960e4f85d683fdbe353adcc5a9e70f9f8b41c5e92470		 pdf-font-stream PDF embedded font (sfnt) at offset 0x83F4 3508 bytes
font_02_sfnt_off0000902f.bin
d59d97e37f9455d28d110b63b622828d8599279e650f2f19a8a5f50834499b94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x902F 4500 bytes
font_03_sfnt_off00009ea7.bin
70b4599045a6088ccf03d98b77689b685280cad84ac7c661026dd83dc3494425		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9EA7 17100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.