Malicious PDF — malware analysis report

Static analysis result for SHA-256 c25c52137f948f05…

MALICIOUS

PDF

69.6 KB Created: 2020-03-20 11:45:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5ffde495a01d102cba145f9c6e02bb10 SHA-1: 22588fa10c3e58b27d571e57f9368aa341bbc242 SHA-256: c25c52137f948f05e2344a2896505c1ed19ade09b3d82b8a5a04ac64c9801993
62 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text is heavily obfuscated and contains references to the wkhtmltopdf tool, suggesting it was generated programmatically. The primary attack pattern appears to be a link farm designed to redirect users to numerous external sites, potentially for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tripanmarketing.com/uploads/1/3/0/7/130739026/130739026.html#el+recurso+de+amparo+en+la+republica+dominicana
    • http://www.rebeccalmontgomery.net/uploads/1/3/0/2/130289426/3524948.pdf
    • http://www.eyitayoimportexport.com/uploads/1/3/0/7/130738512/xizirokavuwenixapa.pdf
    • http://beckandclem.com/uploads/1/3/0/6/130640194/dopera.pdf
    • http://thebestflooringretailers.com/uploads/1/3/0/2/130289341/25675.pdf
    • http://dns.fernleyrepublicanwomen.com/uploads/1/3/0/6/130639091/lowobujaxoz_vosejaxolubub_xevanowivuvif_zedofupoxaxorad.pdf
    • http://www.brandpeace.org/uploads/1/3/0/8/130814715/a6f900c6.pdf
    • http://webdisk.leabowskitchen.com/uploads/1/3/0/6/130621127/4642915.pdf
    • http://screenstore.business/uploads/1/3/0/7/130739072/32fe8596.pdf
    • http://www.tremendoustennis.com/uploads/1/3/0/6/130620295/fejadifopagetoluf.pdf
    • http://doggybagbakery.com/uploads/1/3/0/3/130313272/2707204.pdf
    • http://runyourworld.net/uploads/1/3/0/2/130272484/b09f6.pdf
    • http://fhs1969.com/uploads/1/3/0/7/130775528/sorisinevimir.pdf
    • http://www.hzb-wegberg.com/uploads/1/3/0/4/130483581/7359970.pdf
    • http://uprisingbakery.com/uploads/1/3/0/4/130483781/fa61d1a6.pdf
    • http://www.gcesnonprofit.com/uploads/1/3/0/5/130589115/dijabi.pdf
    • http://deh-assoc-llc.com/uploads/1/3/0/6/130620737/1365892.pdf
    • http://sweet-dreamzzz.com/uploads/1/3/0/7/130776068/5197292.pdf
    • http://glasswhims.com/uploads/1/3/0/5/130540193/wituxe_vumixizo_zalurakuwi.pdf
    • http://hostmaster.allgaeuer-keramik.de/uploads/1/3/0/5/130540746/1475255.pdf
    • http://kurtanglock.com/uploads/1/3/0/3/130323196/tozaxejupoxit.pdf
    • http://nataliadgrafica.com/uploads/1/3/0/2/130271121/7516604.pdf
    • http://michalpaczkowski.com/uploads/1/3/0/8/130874049/7089854.pdf
    • http://mmqualitycreations.com/uploads/1/3/0/2/130289741/sifabirupovebep-lasiwujedasasoz-rozat.pdf
    • http://lynnesgarden.com/uploads/1/3/0/5/130588735/sekawogezaduk-femel-towuvaraf.pdf
    • http://www.cbdmilwaukee.com/uploads/1/3/0/7/130739621/gadamirudani.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e518.bin
49d170c11232d8ed37fdc915352e573680d8be4e9b8cacfbed982954c88f24ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE518 9184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.