Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfab0f19994fbd12…

MALICIOUS

PDF

39.3 KB Created: 2020-04-02 02:58:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6cd58686af5ec18924c55e3c1b5915e7 SHA-1: a9ed678bd50d4e54a485a5030d6fcd4584eccc4a SHA-256: bfab0f19994fbd12a22f7cf75c290882307e759b0ffa610ccd8aa75ad5a12f01
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, identified by the PDF_SEO_LINK_FARM heuristic, which suggests a link farm or redirection scheme. The document body, though partially corrupted, includes text related to a math challenge book and references the wkhtmltopdf application, indicating a potential lure. The primary intent appears to be directing users to a large number of external PDF files hosted on various domains, likely for malicious purposes such as malware distribution or phishing.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://glassactdetailing.com/uploads/1/3/0/3/130323900/130323900.html#libro+de+desafios+matematicos+de+5+grado+con+las+respuestas
    • http://berlin-sachsen-transport.com/uploads/1/3/0/4/130476342/9705799.pdf
    • http://goodchiroaz.com/uploads/1/3/0/8/130815031/8359090.pdf
    • http://tracyphalange.com/uploads/1/3/0/4/130494636/vomasevom.pdf
    • http://premierdesignsevents.com/uploads/1/3/0/4/130489358/zagikididiwiwad.pdf
    • http://kanfuyung-victoria.com/uploads/1/3/0/8/130874183/8555238.pdf
    • http://kirstenboydgoldberg.com/uploads/1/3/0/8/130874082/f0922e34481cff3.pdf
    • http://onlinespellscaster.net/uploads/1/3/1/3/131379085/6007635.pdf
    • http://managinggdminnewbrunswick.com/uploads/1/3/0/8/130874133/8748d53c57.pdf
    • http://tiferetmiami.com/uploads/1/3/0/6/130620501/gaxevujafoginovor.pdf
    • http://wadetreeservicellc.com/uploads/1/3/0/8/130814248/9595798.pdf
    • http://charpentesossaturesbois.com/uploads/1/3/0/8/130874566/xitalo.pdf
    • http://eventosespecialescholula.com/uploads/1/3/0/8/130874645/kakir.pdf
    • http://onworksamples.com/uploads/1/3/0/6/130604703/dubomazesulofutuwegu.pdf
    • http://ketosi.net/uploads/1/3/0/2/130289495/lipizugupozik-datofeludoze-gelis.pdf
    • http://netherplay.org/uploads/1/3/0/7/130775245/pememeweniwud.pdf
    • http://mathwithcassel.org/uploads/1/3/0/7/130775293/tudituma.pdf
    • http://kaqunwellnessspanewjersey.org/uploads/1/3/0/6/130640033/mazekifek.pdf
    • http://thenarrowroad.com/uploads/1/3/0/9/130969922/2659826.pdf
    • http://nashvillecharityball.org/uploads/1/3/0/3/130313854/0c6b06aded8271.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e74.bin
6d87eaec518dd0a297a7da7ce7c68eb5f367ec414d5eda2e1d2ccd3f9a8cf7cf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6E74 9064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.