Malicious PDF — malware analysis report

Static analysis result for SHA-256 b75d4c55aef33878…

MALICIOUS

PDF

39.4 KB Created: 2020-04-07 11:16:49 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 79be3ffc0450c78c1d5074e4b5f37e18 SHA-1: 234fae11a6a12c56e50f332345767324d9a062f2 SHA-256: b75d4c55aef33878d3837ab733482b47fdf20e8084bba9037dd42cea74265ee5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure related to a 'power supply 12 volt 30 amp' but is primarily composed of a large number of external links. The heuristic 'PDF_SEO_LINK_FARM' indicates that the document contains 28 external PDF links, with 'mybagsies.com' being the dominant host. This suggests a tactic to manipulate search engine results or to distribute further malicious content through these links. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kcbevco.com/uploads/1/3/0/5/130539128/130539128.html#power+supply+12+volt+30+amp PDF link annotation
    • http://mybagsies.com/uploads/1/3/1/4/131406835/gumuvi.pdfIn PDF document text
    • http://mindsetmakeover.site/uploads/1/3/0/5/130588939/9456137.pdfIn PDF document text
    • http://evolvelearningstudio.com/uploads/1/3/0/4/130488811/3017942.pdfIn PDF document text
    • http://salesraider.com/uploads/1/3/0/7/130739463/lanokoferudakedajo.pdfIn PDF document text
    • http://becomeplantbased.com/uploads/1/3/0/8/130874498/jufijuzud.pdfIn PDF document text
    • http://m3pros.com/uploads/1/3/0/6/130604039/wanelelu.pdfIn PDF document text
    • http://tannenkrug.com/uploads/1/3/0/4/130488700/gunow.pdfIn PDF document text
    • http://woodlandmountainretreat.com/uploads/1/3/1/4/131437799/6613768.pdfIn PDF document text
    • http://advancedpsychiatricservices.net/uploads/1/3/0/8/130874018/nedegug_vivewugameguk_sodojebovupuf_rerosilevugor.pdfIn PDF document text
    • http://bellathevagablond.com/uploads/1/3/0/7/130740256/7627370.pdfIn PDF document text
    • http://jethelpinghands.org/uploads/1/3/0/8/130814020/xudozamidelami.pdfIn PDF document text
    • http://nax3209.com/uploads/1/3/0/9/130969699/zoveba-pevudarupos-minupemofaga.pdfIn PDF document text
    • http://montgomerylegal.us/uploads/1/3/0/7/130739906/a626a0913a355.pdfIn PDF document text
    • http://mariosaenzlandscapingservices.com/uploads/1/3/0/2/130289543/bokatanagipesa.pdfIn PDF document text
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
    • http://purl.org/dc/elements/1.1/In PDF document text
    • http://ns.adobe.com/pdf/1.3/In PDF document text
    • http://ns.adobe.com/xap/1.0/In PDF document text
    • http://ns.adobe.com/xap/1.0/mm/In PDF document text
    • http://ns.adobe.com/xap/1.0/rights/In PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007087.bin
aadc18f2ebd949787b134bab89c2cf161ac7c7f4194762b04f89dc765b0921bc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7087 8364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.