Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7d397891888d2f7…

MALICIOUS

PDF

35.7 KB Created: 2020-03-31 00:38:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8d4ec8770b05f7e5a6fd08a369c06c09 SHA-1: 91636276c40ea88c1e32a2dafbea250b743258d3 SHA-256: b7d397891888d2f7ae616f126f7fb3ebe0845dacec48e49f6641d995395d99b1
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO spam operation. The document body, while containing garbled text, also includes a URL that appears to be a lure for a TV show episode. The primary function appears to be directing users to a network of potentially malicious or ad-filled websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://asianpaedsderm.org/uploads/1/3/0/2/130289266/130289266.html#el+secreto+de+feriha+capitulo+108+completo+en+espa%C3%B1ol
    • http://makeituniquelyyoursgifts.com/uploads/1/3/0/9/130968943/werajuxiwenalufagu.pdf
    • http://howlingmoonsshepherds.com/uploads/1/3/0/7/130776394/9626fa998ce69f.pdf
    • http://www.superscoreme.com/uploads/1/3/0/7/130775759/5694782.pdf
    • http://face-me.net/uploads/1/3/0/6/130604775/69e7b674df0f9.pdf
    • http://soyamore.com/uploads/1/3/0/2/130272420/ce1e52575.pdf
    • http://back-under-construction.com/uploads/1/3/0/6/130621383/luwar.pdf
    • http://beautykonstanz.com/uploads/1/3/1/1/131163969/zusawadugakufaru.pdf
    • http://bpmchair.com/uploads/1/3/0/2/130291328/5752139.pdf
    • http://gholmeshelps.com/uploads/1/3/0/5/130589229/68cdf7497fd.pdf
    • http://fredhessdvmllc.com/uploads/1/3/0/7/130739333/370879f.pdf
    • http://okcwood.com/uploads/1/3/0/3/130379094/981b0f872eb7d45.pdf
    • http://episcopaldioceseofsc.com/uploads/1/3/1/0/131070619/05985.pdf
    • http://lornahooddesigns.com/uploads/1/3/0/7/130740092/sigetomevo.pdf
    • http://jf2management.com/uploads/1/3/0/5/130539981/4892900.pdf
    • http://burnsserver.net/uploads/1/3/0/7/130739070/4e295198bed41.pdf
    • http://onephiladelphia2017.com/uploads/1/3/0/8/130874235/vudupijamufojo_xajiredixosav.pdf
    • http://victorvillefamilylawattorney.com/uploads/1/3/0/5/130588712/xipafavawozutaw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ddd.bin
32cc4b6c43e5b3dfed0a78704658412119c824d04bf196df92aebf4bbf198033		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DDD 9584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.