Malicious PDF — malware analysis report

Static analysis result for SHA-256 b5cfe641d4e951ed…

MALICIOUS

PDF

32.9 KB Created: 2020-04-26 03:20:13 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 569a03fb8b61232be4823ae954f316ac SHA-1: acf844ee101aac97f924117c078228f585a3b851 SHA-256: b5cfe641d4e951ed799aaebff7769a7e58c154a9be58888abc27debdf878d95e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links pointing to various domains, a technique often used for SEO manipulation or to redirect users to malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a mass of external PDF links, suggesting a link farm or redirection scheme. No scripts were extracted from this sample, and the document body is heavily obfuscated, making it difficult to determine a more specific user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alexandrarickard.com/uploads/1/3/1/4/131407163/131407163.html#samuel+coleridge+taylor+sheet+music
    • http://barbienoriega.com/uploads/1/3/1/3/131381772/xokop_sasibiremigava_xijafeved.pdf
    • http://porcus-sanus.de/uploads/1/3/0/5/130550966/diwurux.pdf
    • http://darkbrownskin.com/uploads/1/3/0/2/130273993/101e0f0f629fdb.pdf
    • http://jmartinbuildingltd.com/uploads/1/3/1/4/131406387/02e3b1203bca4.pdf
    • http://madisonhomeinspection.net/uploads/1/3/1/4/131437396/xosobapo-ronesobovadob-temenejese-dimifuvo.pdf
    • http://lonestarcrystals.com/uploads/1/3/0/2/130271139/02a55.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.