Malicious PDF — malware analysis report

Static analysis result for SHA-256 c792f5a2fdb8af80…

MALICIOUS

PDF

41.9 KB Created: 2020-03-29 13:18:27 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 428637eb955b60b0fc7f197df4cbf753 SHA-1: 1171812e519c5715f51e5552d4f976969a022091 SHA-256: c792f5a2fdb8af80ed45f178244a1b2f9095283454228a0575eaae221e990ce3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes a URL that points to a collection of PDF files. This suggests a link farm or SEO manipulation tactic, potentially used to distribute malicious content or improve search engine ranking for malicious sites. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mysoundcollective.com/uploads/1/3/0/7/130775838/130775838.html#sistema+nervioso+periferico+partes+y+funciones
    • http://tabboren.com/uploads/1/3/1/0/131070334/4271352.pdf
    • http://abhmembers.com/uploads/1/3/0/2/130287536/givaz_tavox_fuzonem.pdf
    • http://stillwellsalestrailers.com/uploads/1/3/1/0/131071125/gutemagikenuxa-wibelelijotiki-befunejub-jomedudurenova.pdf
    • http://aapnebobber.no/uploads/1/3/0/4/130483811/moperepapabe_paterasu.pdf
    • http://beautybyanna.us/uploads/1/3/1/3/131398356/wiwepavakonafole.pdf
    • http://valley-braids.com/uploads/1/3/0/7/130739105/dejurovaxikelinuli.pdf
    • http://agentbrassband.com/uploads/1/3/0/6/130605380/gonumeko-bosimero.pdf
    • http://hostmaster.constructioncanada.ca/uploads/1/3/0/7/130776425/rikexuwawijej.pdf
    • http://sailboatsandcocktails.com/uploads/1/3/0/6/130604168/9651271.pdf
    • http://always-podcast.com/uploads/1/3/1/1/131163984/8142126.pdf
    • http://vmnh.store/uploads/1/3/0/5/130589008/006fad73f75789.pdf
    • http://proyectonativa.org/uploads/1/3/0/6/130639516/wurixazopu.pdf
    • http://myjavatraining.com/uploads/1/3/0/3/130323984/2485479.pdf
    • http://willemdenboer.nl/uploads/1/3/0/2/130271113/171f130.pdf
    • http://vanbrosirragation.com/uploads/1/3/1/0/131070377/xazuzalojidulaz-napokamijeg.pdf
    • http://roundupforstartups.net/uploads/1/3/0/4/130435722/taremisolor.pdf
    • http://capitoleducation.org/uploads/1/3/0/6/130603907/66577c5f.pdf
    • http://primarycolorsartforkids.com/uploads/1/3/0/6/130639199/cafb11b.pdf
    • http://buttercreamfestival.com/uploads/1/3/0/9/130969385/lemikemujox_jabidaze_zipumilegivo.pdf
    • http://autosofiaciente.com/uploads/1/3/0/7/130775979/a73418.pdf
    • http://mdexpertwitness.com/uploads/1/3/0/7/130739363/a19bc55a601890.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000077e9.bin
4934209cf34679945c10382391cfef82879c4259ee4f5893ca49bc709fefd285		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77E9 8872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.