Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1ceed243cbd056a…

MALICIOUS

PDF

65.0 KB Created: 2020-03-07 11:02:17 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5713b881800411e6fc37b85c2a2d6481 SHA-1: d440c9aa030c229bcd6d0f5c3d7694138dbd16d5 SHA-256: c1ceed243cbd056a421c7208ed5e15f38f4f5b612f1e718b518b765c9ba15f01
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used to redirect users to malicious websites or phishing pages. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a deliberate attempt to create a link farm. The document body contains a title related to 'Aegis legend mod battery low protection', which may be a lure to entice clicks on the numerous links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fergodwear.net/uploads/1/3/0/4/130476145/130476145.html#aegis+legend+mod+battery+low+protection
    • http://burgangt.com/uploads/1/3/0/4/130476054/kisenobud_fepugum_puwerojo.pdf
    • http://punkrockandpretty.com/uploads/1/3/0/2/130270931/4799758.pdf
    • http://thesugarlifeco.net/uploads/1/3/0/8/130814355/puwez_sesosowesoviwi_pusidovoxi_pefades.pdf
    • http://cultcom.ch/uploads/1/3/0/6/130621210/desamafekikul-zuviregunekuwa.pdf
    • http://www.rainextentions.com/uploads/1/3/0/8/130813866/tuxiwadafotiwe-giviputubemode.pdf
    • http://uclwomeninfinance.com/uploads/1/3/0/9/130969265/zitexolatonix.pdf
    • http://aestheticsplus.club/uploads/1/3/0/5/130588574/mekeviwaju_fojuker.pdf
    • http://opiniononline.net/uploads/1/3/0/3/130313605/fujenesopizutitifeti.pdf
    • http://www.revolutionipdesigns.com/uploads/1/3/0/6/130604742/2961645.pdf
    • http://bthebuyer.com/uploads/1/3/0/6/130639160/a7f194fcdb.pdf
    • http://midwestrepsales.com/uploads/1/3/0/5/130541351/jifokidisuvuz.pdf
    • http://romelocaltourguides.com/uploads/1/3/0/6/130603692/tezovenij-fenasuwu-kabigokimalidov-lavomiwagu.pdf
    • http://www.graywolfpestcontrol.ca/uploads/1/3/0/2/130289640/a392f.pdf
    • http://briarheights.co.uk/uploads/1/3/0/7/130776105/4ac524f43.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b3e8.bin
bbd2aa11f78c9abad7bdb5c5217222a3fa6cceacdb3a552b8ccde0a7c779d4af		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB3E8 13980 bytes
font_01_sfnt_off0000e002.bin
a1e98d702da61a64b27f8eba7d17f87ed4b179c7029e8dd91cf3634515fe850b		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE002 4152 bytes
font_02_sfnt_off0000ed0c.bin
a2f0e64d6975656d959a0794b9a965349b6a87240c16eb122ddb64596f86590d		 pdf-font-stream PDF embedded font (sfnt) at offset 0xED0C 1704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.