Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6fa815468c69eaf…

MALICIOUS

PDF

60.6 KB Created: 2020-04-10 00:52:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 93e9a46b38b4230f36af68a354cb0ad1 SHA-1: 65f0f22e33d7153a65450fd705e3a1234cd435a5 SHA-256: c6fa815468c69eafb42d67f42c815e6346e98d3c3a9e95270aaa10599b7a9f73
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links to other PDF files hosted across numerous domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The document body text is largely unreadable, but the presence of the URL 'http://myentouragemusic.com/uploads/1/3/1/4/131438729/131438729.html#you+learn+by+living+pdf' suggests a potential lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myentouragemusic.com/uploads/1/3/1/4/131438729/131438729.html#you+learn+by+living+pdf
    • http://webstersnc.com/uploads/1/3/0/7/130775431/8867705.pdf
    • http://printalluk.com/uploads/1/3/0/6/130620736/8890169.pdf
    • http://bitcoinhamster.com/uploads/1/3/0/6/130605203/kibaxujeme.pdf
    • http://redifinancialservices.com/uploads/1/3/1/0/131069906/7507049.pdf
    • http://jinty.online/uploads/1/3/1/0/131070476/nusevapokuzosite.pdf
    • http://sgcinsight.com/uploads/1/3/0/5/130589252/2615590.pdf
    • http://ipekgurer.com/uploads/1/3/0/8/130874366/zojitovuwuxovubebex.pdf
    • http://neurosleepcenter.org/uploads/1/3/0/6/130621839/ab53813c.pdf
    • http://chippewavalleytrailguide.com/uploads/1/3/0/5/130588584/2ecf28e0.pdf
    • http://scgist.com/uploads/1/3/0/6/130604728/8845930.pdf
    • http://baroquesaxophone.com/uploads/1/3/0/6/130604226/504295.pdf
    • http://kaitiakisisters.com/uploads/1/3/0/6/130639373/643643.pdf
    • http://gallyspromotrophiesandawards.com/uploads/1/3/0/7/130775510/pezutulez.pdf
    • http://sovonto.com/uploads/1/3/0/7/130775853/wudunorofuse_rajunoru.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009f80.bin
9160f05bd8e1688280bf0f4d544af5730ce23b5c6a361967d3d340083d3d752c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F80 8964 bytes
font_01_sfnt_off0000c1a0.bin
3786621a70232dbedc177bbdff57111b150460433d7c5439a50018624ba61495		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC1A0 3012 bytes
font_02_sfnt_off0000cc2e.bin
4898f435c77757431571a0b36d2d3a6a4ce3710292494908416bdb94ba70ae1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCC2E 17168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.