Malicious PDF — malware analysis report

Static analysis result for SHA-256 b60bdd23fa7c643b…

MALICIOUS

PDF

38.5 KB Created: 2020-03-21 19:57:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 83876623cb515cd6e4c25b99a856f9e5 SHA-1: 7d6d8dff2eb6095356925cbbe0fba7ef0d184492 SHA-256: b60bdd23fa7c643bced2a0fe2578ab261e5fd42e343d3673cdd93983df625f00
122 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.001 Spearphishing Attachment

This PDF file was detected as a dropper by ClamAV. It contains a large number of external links, many of which point to other PDF files hosted on various domains, indicating a link farm strategy. The primary URL found in the document body is http://teachthewaytheylearn.org/uploads/1/3/0/6/130604255/130604255.html#counterfeit+gods+tim+keller+review, which likely serves as a lure or initial redirection point. The overall pattern suggests an attempt to distribute further malicious content or phishing pages.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-9236722-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9236722-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://teachthewaytheylearn.org/uploads/1/3/0/6/130604255/130604255.html#counterfeit+gods+tim+keller+review
    • http://roadtripkit.com/uploads/1/3/0/7/130738619/6ebbd0be3bc8030.pdf
    • http://nilsravalvecoverracing.com/uploads/1/3/0/7/130776304/b5c4bc35ba.pdf
    • http://www.chiropracticsurvivalguide.com/uploads/1/3/0/2/130287997/nazawagudu.pdf
    • http://buzzingthoughtsofficial.com/uploads/1/3/0/7/130740068/xinunalubuxobenega.pdf
    • http://brew-niverse.com/uploads/1/3/0/7/130776078/ximutagagax.pdf
    • http://streetbrunch.com/uploads/1/3/0/6/130621156/vepeporesur.pdf
    • http://eventsbyemilie.net/uploads/1/3/0/9/130969262/6642529.pdf
    • http://suertes13optica.com/uploads/1/3/0/5/130539849/dc32696.pdf
    • http://www.glenrockarboretum.org/uploads/1/3/0/3/130379352/1812243.pdf
    • http://www.nbarth.com/uploads/1/3/0/2/130287989/7de15fa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006edf.bin
ceed250b6504c4ce5d0d1279d54edb1e14ab6f707ee33155212c9d9f19dbdd2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EDF 7352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.