Malicious PDF — malware analysis report

Static analysis result for SHA-256 bed438c4a38b323b…

MALICIOUS

PDF

42.8 KB Created: 2020-03-30 23:15:00 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7d716d81657eeee4a438cf43e6947e44 SHA-1: 4ecf9fa8f522e2b1225a677accd7760277a1b8a5 SHA-256: bed438c4a38b323b1c30a89102b071c64136c68bba36bc814598fa7ef272da05
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates a mass external link farm within a small PDF. The document body contains a URL that matches one of the embedded links, suggesting a deliberate attempt to direct the user to external content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hangarfitness.com/uploads/1/3/0/6/130639161/130639161.html#que+significa+nombre+chantelle
    • http://keystone-usa.net/uploads/1/3/0/8/130874282/duwilati.pdf
    • http://morishjems.com/uploads/1/3/0/5/130545666/5a7b6a2.pdf
    • http://camillagantministries.org/uploads/1/3/0/5/130539455/musubof.pdf
    • http://what2shop.net/uploads/1/3/0/7/130739592/75add0d6792e6.pdf
    • http://aimnetwork.co/uploads/1/3/0/5/130540197/9ab9fd1cc42f.pdf
    • http://thefadeschool.com/uploads/1/3/0/4/130435706/gojadenab.pdf
    • http://142ellert.com/uploads/1/3/0/5/130589220/sedowupepuwel.pdf
    • http://behappyespana.com/uploads/1/3/0/5/130540359/5332792.pdf
    • http://unsubscribetoviolence.com/uploads/1/3/0/6/130604821/sagewizupukafeka.pdf
    • http://jcustomelectric.com/uploads/1/3/0/8/130874241/c18661a2.pdf
    • http://theconsciousseed.org/uploads/1/3/0/7/130739714/fa5bd8574.pdf
    • http://appleglade.com/uploads/1/3/1/3/131379896/9405601.pdf
    • http://cancun-tickets.com/uploads/1/3/0/6/130621857/wosevegadam_vuzuxapa_zilenuv_kixaj.pdf
    • http://hebrewapostolic.org/uploads/1/3/0/4/130483389/9dab7a063adf.pdf
    • http://xtreme3dhouse.com/uploads/1/3/1/0/131070073/670552de87.pdf
    • http://jennastoner.ca/uploads/1/3/0/2/130291786/646cf95260b.pdf
    • http://weybridge10k.com/uploads/1/3/0/8/130874085/fugusanuxewev-sevuwavadolunab-nubelaxetaga-wixiro.pdf
    • http://highendhippie.co/uploads/1/3/0/5/130543394/3b288.pdf
    • http://4gkingdomliving.com/uploads/1/3/1/0/131069923/3851236.pdf
    • http://milestonestherapygroup.com/uploads/1/3/0/6/130620798/safebipu.pdf
    • http://oxoacademy.com/uploads/1/3/0/7/130775646/bikefedu.pdf
    • http://kinseyfire.com/uploads/1/3/0/4/130435590/dc4347b636d7.pdf
    • http://www.vanbeekassociates.com/uploads/1/3/1/4/131437443/sovipulexev.pdf
    • http://5theccs.com/uploads/1/3/1/1/131164542/16d0e1b94c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b63.bin
f5c0a83bb277030a9f0ea8b83b9c6f472c92b7d83510c2b2b825fd75f2b0dded		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B63 9548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.