Malicious PDF — malware analysis report

Static analysis result for SHA-256 c39795e1f4aa13ac…

MALICIOUS

PDF

39.7 KB Created: 2020-03-28 13:46:10 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 503123315a1454ad324301cd630b48b7 SHA-1: 82242571ffdce92b5b09ce86b9d9fe3895cff39b SHA-256: c39795e1f4aa13ac938f90e6be0555b559aa22c685ceed2d54ee4dfe91c042f4
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are numerically or generically named PDFs, suggesting a link farm for SEO manipulation or to host malicious content. The document body contains text related to 'billing document condition record table in sap', which is likely a lure to make the links appear legitimate. The primary heuristic indicates a mass external PDF link farm, with multiple URLs pointing to similarly structured paths on various domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chicagoreef.com/uploads/1/3/0/6/130639960/130639960.html#billing+document+condition+record+table+in+sap
    • http://resinasjapao.com/uploads/1/3/0/5/130550813/dufulupuxutida.pdf
    • http://www.troop10fairfield.com/uploads/1/3/0/5/130543453/kuwezazi-wenobowezenima-nejesavisapuz-posuw.pdf
    • http://outsideinmassage.com/uploads/1/3/0/5/130539269/sugen_ruxorexufujifug.pdf
    • http://die-haarentferner.de/uploads/1/3/0/2/130287419/zujakomugi_nowew_zigiwodizor.pdf
    • http://www.castledownradio.info/uploads/1/3/0/7/130776498/refunivifadi_kebawesagud.pdf
    • http://mojavebows.com/uploads/1/3/0/5/130543188/zeforigelezemuz.pdf
    • http://info.amicusgreen.com/uploads/1/3/0/7/130739423/winezugapo_sunivuxijadewe_woravavigafexuz.pdf
    • http://mta-sts.mail.noahsarkma.org/uploads/1/3/0/4/130483477/5879268.pdf
    • http://www.synchroski.org/uploads/1/3/0/7/130739814/187f13fea9a8.pdf
    • http://sojusurvivor.com/uploads/1/3/0/2/130289426/vatukalugimugeg.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006851.bin
844cf1f38fa0f6765a2fdca4d1c2981a97361d9ece42db4af4d14d9966f818f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6851 8100 bytes
font_01_sfnt_off000087e7.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87E7 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.