Malicious PDF — malware analysis report

Static analysis result for SHA-256 c18c576d8528382a…

MALICIOUS

PDF

49.2 KB Created: 2020-04-01 19:04:55 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7fc6d5f6a0da2979e7c5377dd3e8ef18 SHA-1: 1e4f546c5879f5df6476e154613966b1c078c000 SHA-256: c18c576d8528382a158147b5477dd90aede1554eec9fd9d44c90fe825761d9ce
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many pointing to similarly structured URLs on different domains. This pattern is indicative of a link farm or SEO manipulation scheme. The primary heuristic identified a mass external PDF link farm, suggesting the document's purpose is to redirect users to these external sites. No scripts were extracted, limiting further analysis of direct malicious actions.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://whyagileteamsfail.com/uploads/1/3/0/4/130476709/130476709.html#serge+lang+algebraic+number+theory
    • http://barbiescloset.co/uploads/1/3/0/8/130874672/mukawup_nobukefu.pdf
    • http://acorn-cookies.com/uploads/1/3/0/5/130588724/2909440.pdf
    • http://thedenimdog.com/uploads/1/3/0/4/130476368/5935441.pdf
    • http://mydarlingvalentine.com/uploads/1/3/0/4/130436089/zesazum-tokazikada-rawevovo.pdf
    • http://ashleymariniphotography.com/uploads/1/3/0/5/130588670/5227072.pdf
    • http://hmgaccounting.com/uploads/1/3/0/5/130589058/8072710.pdf
    • http://driedstuff.com/uploads/1/3/1/3/131381782/refuxefezudoniruzixa.pdf
    • http://soypoetic.com/uploads/1/3/0/7/130739625/1410282.pdf
    • http://binhduongcomputer.net/uploads/1/3/0/7/130775743/53d9000.pdf
    • http://philipnott.com/uploads/1/3/0/5/130551249/xogivojo_dapozudotivon_dexofarenujos.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000081e3.bin
bcc7256343aef4b627c34f75005714d83897519d3ab3278953a287adfd1b56f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81E3 8208 bytes
font_01_sfnt_off0000a113.bin
e134ee7c55a27c92386503d43d15f597138799f81fc7ce80a14ee5c6015c85d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA113 16428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.