Malicious PDF — malware analysis report

Static analysis result for SHA-256 c30a2dbad60d63e6…

MALICIOUS

PDF

95.4 KB Created: 2020-03-09 07:31:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 551ca68e3cd88008e8fea8124db705d1 SHA-1: c8aea4e3d06bf21753ac626498c59b9a325dd249 SHA-256: c30a2dbad60d63e6f087c87a3fc37f31143831b3f52bc7798fe1672de6b5b57e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that is also present in the list of extracted URLs. This suggests the primary function of this PDF is to act as a link farm, directing users to numerous other websites, potentially for SEO manipulation or to host further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bslartquilts.com/uploads/1/3/0/6/130604543/130604543.html#alibaba+chalis+chor+moral+story+in+hindi
    • http://peachy3d.com/uploads/1/3/0/3/130323216/xutinexalujofavebof.pdf
    • http://morriscorporatecenteriii.com/uploads/1/3/0/2/130291485/d471043dbb3b5.pdf
    • http://mr-spa.co.uk/uploads/1/3/0/6/130621613/1618405.pdf
    • http://www.ryansbakery.shop/uploads/1/3/0/6/130621214/fenunakibow.pdf
    • http://morenoguerrero.com/uploads/1/3/0/7/130740550/fc0baf76c1.pdf
    • http://minnieripertonfund.org/uploads/1/3/0/4/130491488/munosuvuxigavon-dusateja-zapiwi.pdf
    • http://www.caromcorner.com/uploads/1/3/0/5/130588415/bafazapok-muxuto-jufibepu.pdf
    • http://bobatree.site/uploads/1/3/0/6/130603818/6348445.pdf
    • http://sfsparkscheerleading.com/uploads/1/3/0/6/130620293/4135c43c.pdf
    • http://jillgrens-bigbangbooks.com/uploads/1/3/0/5/130545998/2524273.pdf
    • http://celsosim.com/uploads/1/3/0/4/130476885/1f7b5f7cd8b2.pdf
    • http://www.slbconsultingservices.com/uploads/1/3/0/5/130551927/54e5349da2.pdf
    • http://distribuidoramaissaude.com/uploads/1/3/0/6/130639145/dc212da56f1b.pdf
    • http://mbhmanagement.com/uploads/1/3/0/4/130490410/1205902.pdf
    • http://trevionburns.com/uploads/1/3/0/5/130543575/792269.pdf
    • http://www.rebeccaparfrey.com/uploads/1/3/0/4/130491947/jizowogujopolesu.pdf
    • http://mx.cfcstuttgart.org/uploads/1/3/0/6/130605435/tovavoj.pdf
    • http://amy-thomas.co.uk/uploads/1/3/0/5/130589241/3172072.pdf
    • http://casbaad.it/uploads/1/3/0/5/130543761/1239927146f3.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00010f53.bin
9db98b67f53fb453850eafc6643b0af0160382b96f940790e184a156d670b972		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10F53 7792 bytes
font_01_sfnt_off00012db9.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12DB9 1388 bytes
font_02_sfnt_off0001351f.bin
c4b018abab01506be124cab21b89660b3db04671060dab6e9bf24f6f716f9697		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1351F 20824 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.