Malicious PDF — malware analysis report

Static analysis result for SHA-256 c481cc06786dde66…

MALICIOUS

PDF

47.3 KB Created: 2020-03-29 12:41:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 562ed4cdd6252f1b1b095a17ac62d12b SHA-1: a578acca775f448142caf05490178a0b3f9203a4 SHA-256: c481cc06786dde6671146760e8f86379237d2cd39d1ab9556b4efba6601b2fa9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or distribution network. The primary purpose appears to be directing users to external content, potentially malicious, rather than delivering a direct payload within the PDF itself. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-76-213.mgwnet.com/uploads/1/3/0/5/130590029/130590029.html#reengineering+the+corporation+%281993%29+pdf
    • http://theharvey.net/uploads/1/3/1/4/131438113/a18f42248.pdf
    • http://drewgentleart.com/uploads/1/3/0/5/130589239/1251587.pdf
    • http://softasr.com/uploads/1/3/0/6/130620613/zogujevi.pdf
    • http://yourfavoritedetailers.com/uploads/1/3/0/3/130312985/9343749.pdf
    • http://provokindness.org/uploads/1/3/0/6/130603900/kizez-lixikiwe-vamulosakatomi.pdf
    • http://sow2grow.online/uploads/1/3/0/5/130590310/cf708b31a2.pdf
    • http://violettaesmalteria.com/uploads/1/3/0/6/130639565/votigo.pdf
    • http://fryburgmarblemayfest.com/uploads/1/3/0/6/130639471/e6e9de.pdf
    • http://radiancebeautybytara.com/uploads/1/3/0/5/130588721/debomasejujuloxi.pdf
    • http://estadiosaprissa.com/uploads/1/3/0/2/130273846/nipevufuxewakofitufi.pdf
    • http://topnailwraps.com/uploads/1/3/0/7/130738567/8620efe489c8b43.pdf
    • http://houseonreddirtroad.com/uploads/1/3/0/4/130477170/bugeso.pdf
    • http://solarmercury.com/uploads/1/3/0/2/130289583/tabux_jununuzidox.pdf
    • http://geogbarrbeacon.com/uploads/1/3/1/1/131164132/432edd7.pdf
    • http://vrarcadeconference.com/uploads/1/3/0/8/130813420/livojagolixanipo.pdf
    • http://scruggsmetalwork.com/uploads/1/3/0/2/130287852/6225305.pdf
    • http://galleryeda.com/uploads/1/3/0/5/130543121/tudefolijinebel.pdf
    • http://brownscarpetcare.net/uploads/1/3/0/6/130604805/gibowekosenatifam.pdf
    • http://evansmultiplesolutions.com/uploads/1/3/0/6/130639294/40fab8b35033b2a.pdf
    • http://emmaspudsandbakes.com/uploads/1/3/0/6/130639951/savisivekov-wazojakugi.pdf
    • http://bewear2kxtensions.org/uploads/1/3/0/5/130588588/94227.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007ea8.bin
620fd8b4e258fac3dc02a4e15bf840a58c124fa93f329b2a87a1f4b008c62834		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7EA8 6552 bytes
font_01_sfnt_off00008ecb.bin
e62de12b5d742fca325b7e71461e0a5461f53c65c7173568e79573cba6ec3661		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8ECB 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.