Malicious PDF — malware analysis report

Static analysis result for SHA-256 c33953362f75bc28…

MALICIOUS

PDF

45.8 KB Created: 2020-03-31 05:55:41 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 59a8aa905244f5d986f3c2dbfee3b72c SHA-1: 73b00c17115bb62c45918201190ef5df70526fba SHA-256: c33953362f75bc2866f16ced9fb03ea15192e72b481573817f9bcfda9ea125dc
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious websites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a potential phishing or malware distribution attempt. The document body, though heavily obfuscated, contains references to URLs that are likely part of this link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://khpottery.com/uploads/1/3/0/3/130379367/130379367.html#star+wars+thrawn+alliances+pdf
    • http://trwalk.com/uploads/1/3/0/8/130813835/2545051.pdf
    • http://pbfrealestate.com/uploads/1/3/1/3/131379716/0866a.pdf
    • http://mybodyfitmeals.com/uploads/1/3/0/6/130639217/jesepobexisunuwit.pdf
    • http://milesalumniatl.com/uploads/1/3/0/6/130604823/jagodagujoma.pdf
    • http://jessicaerinswanson.com/uploads/1/3/0/3/130323453/tuzaxebitubalava.pdf
    • http://warsendwithme.com/uploads/1/3/0/6/130604065/lajiwojalabugu.pdf
    • http://arduinoteacher.com/uploads/1/3/1/4/131407424/a36150cad90f7.pdf
    • http://disdiy.com/uploads/1/3/0/4/130490643/9d651b0539.pdf
    • http://pnwyouthsportsexpo.com/uploads/1/3/1/4/131437831/gowexubasepes_tovibixuromup.pdf
    • http://readymoneyatm.net/uploads/1/3/0/4/130436127/4658421.pdf
    • http://laulimagroup.com/uploads/1/3/0/4/130488399/vadasixiz.pdf
    • http://ketamineintegration.com/uploads/1/3/1/3/131378850/sotelavuro.pdf
    • http://percussionmatters.com/uploads/1/3/0/6/130621220/mosutaxoxudo.pdf
    • http://entgrc.com/uploads/1/3/1/0/131070637/c9db9a56909.pdf
    • http://azulmusicstore.com/uploads/1/3/0/8/130813144/04b685de3b.pdf
    • http://www.janibotanicals.com/uploads/1/3/0/6/130603847/wimal.pdf
    • http://strategiesmd.com/uploads/1/3/0/5/130547884/8f71621f09.pdf
    • http://aurorastandardpoodles.com/uploads/1/3/1/3/131380078/5ecbbca.pdf
    • http://murrayforward5.com/uploads/1/3/0/5/130551456/8106469.pdf
    • http://sondreabeautystudio.com/uploads/1/3/0/3/130323406/zojeposove-jogomoxotujeki-tatopixekadoza-nisadagi.pdf
    • http://australiatyres.com/uploads/1/3/0/7/130776874/tileretujid_zototetegawo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008a3d.bin
24fb8836709183da83d30b445851569ef22deabe986456119c86702f0d46320c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A3D 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.