Malicious PDF — malware analysis report

Static analysis result for SHA-256 b9ee23f4cf614cb1…

MALICIOUS

PDF

32.0 KB Created: 2020-04-02 07:47:04 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 71151451a6c3b1808a2a508a44ed77da SHA-1: 4634ab020c059760d57b50dc277f6b4923f17ebe SHA-256: b9ee23f4cf614cb12d6e339db9a2557aeec672a7525dbc98898cf7f9b2966d66
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior. The document body, though partially corrupted, contains text related to educational topics, which may serve as a lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seizetheworld.club/uploads/1/3/0/5/130550952/130550952.html#aprendizajes+esperados+del+segundo+trimestre+cuarto+grado
    • http://jollyollykids.com/uploads/1/3/0/4/130476161/3317180.pdf
    • http://atlpoolcleaners.com/uploads/1/3/0/7/130740592/doxelexepedadix.pdf
    • http://flatheadlakemassage18.com/uploads/1/3/0/6/130603932/xamejixezan.pdf
    • http://wendysmithportraits.com/uploads/1/3/0/6/130604004/8232015.pdf
    • http://patriciamaldonadorealtor.com/uploads/1/3/0/4/130488087/7484687.pdf
    • http://vacanthomestaging.com/uploads/1/3/0/9/130969944/a1562268202245.pdf
    • http://weloveamericasheros.org/uploads/1/3/0/6/130621304/vodizavurodimu_nezifad_boxebopafifedap_vakadubem.pdf
    • http://kimduyentrannguyen.com/uploads/1/3/0/6/130639508/1236985.pdf
    • http://lacuencadelriopiedras.com/uploads/1/3/0/5/130588833/tedokefirub.pdf
    • http://saltyblondehair.com/uploads/1/3/0/7/130775472/nakoti-mujudova.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051c1.bin
25492e6100af1296688ad9ceb20743e558aceb58868eebd363734bb58305b81b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51C1 8664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.