Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4876c89618ad0bf…

MALICIOUS

PDF

29.1 KB Created: 2020-04-20 14:19:34 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3a57f92d0bb0bb3825e6e4124e8a71a3 SHA-1: 439c8659867386645e7653b18239b3afeca6e01c SHA-256: c4876c89618ad0bf959b4be33a3458fde09be1ea38b173190a2ebcc8937bef73
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or SEO manipulation tactic. The document body is heavily obfuscated but contains some of the URLs, reinforcing the link-based attack pattern. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://yourfashionfarmer.com/uploads/1/3/1/4/131411341/131411341.html#bhojpuri+dj+gana+video
    • http://chaoscrystals.com/uploads/1/3/0/5/130551554/radedada.pdf
    • http://gina-guerrieri.com/uploads/1/3/0/6/130639076/6631544.pdf
    • http://streamlinelogistics.net/uploads/1/3/0/5/130590158/3757736.pdf
    • http://yournvee.com/uploads/1/3/0/8/130874212/moziwifurumeluvat.pdf
    • http://tradetilingroup.com/uploads/1/3/0/5/130538946/lewutofej.pdf
    • http://umbrellaworks.org/uploads/1/3/0/6/130621472/mosamirugoli.pdf
    • http://thedollpeoplemusical.com/uploads/1/3/0/4/130477346/bc953332740.pdf
    • http://amyrenaudconsulting.com/uploads/1/3/1/4/131453749/c7a2863b1f44.pdf
    • http://gerdgone.com/uploads/1/3/0/6/130639074/7913275.pdf
    • http://voelter-s.de/uploads/1/3/0/5/130539311/7628342baada.pdf
    • http://dyconseils.org/uploads/1/3/1/6/131636766/vinapa-momex-daxudug.pdf
    • http://istria-luxuryvillas.com/uploads/1/3/0/4/130476248/3359707.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004be8.bin
855c8825a6d90b653e253cbaf291b80c7c4797f026a5a7fa7f8fb5886900eaa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BE8 7328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.