Malicious PDF — malware analysis report

Static analysis result for SHA-256 c797ba3e4d3b99a7…

MALICIOUS

PDF

51.1 KB Created: 2020-04-03 02:31:31 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3b04ec3ca2ffb941eed75bd95d2141e8 SHA-1: b29a2f571de6d93107b0d3805ce1e475dc6d8692 SHA-256: c797ba3e4d3b99a7489ec087174fef488b21d0c8519bfd810cfd7e6390c89f30
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The PDF_SEO_LINK_FARM heuristic specifically identified this behavior, pointing to a mass of external PDF links. The primary URL http://ereksitahanlama.com/uploads/1/3/0/6/130622011/130622011.html#milwaukee+electromagnetic+drill+press+4270-20 appears to be a lure, while the other numerous links likely lead to further malicious or spam content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ereksitahanlama.com/uploads/1/3/0/6/130622011/130622011.html#milwaukee+electromagnetic+drill+press+4270-20
    • http://elevones.com/uploads/1/3/0/9/130969415/visufebujisom.pdf
    • http://nicorosch.com/uploads/1/3/1/4/131406455/moloduxom-xozapem-mavaj-debenekonofaj.pdf
    • http://generationepac.org/uploads/1/3/0/6/130603867/dupisu-dusukito-mizesitakifafu.pdf
    • http://1333nkingsbury.com/uploads/1/3/0/5/130589179/3dccd428c.pdf
    • http://drlyons.net/uploads/1/3/0/4/130436058/gadimawuxukas-vatov-mabinevuzesog-surukufiro.pdf
    • http://4do.nl/uploads/1/3/1/3/131384021/badeseg_fenabime_mududofil.pdf
    • http://michellecmcadams.com/uploads/1/3/0/8/130874210/3272039.pdf
    • http://ohscheerandstunt.com/uploads/1/3/0/9/130969851/gotide.pdf
    • http://vallejotreeservice.com/uploads/1/3/0/2/130271111/ee0d9710b1d9.pdf
    • http://brooklyncouch.com/uploads/1/3/0/3/130313265/0437dfa654.pdf
    • http://pcasingers.com/uploads/1/3/1/1/131163920/223882.pdf
    • http://highrisetreeservicellc.com/uploads/1/3/0/2/130270937/d5f8e0ffa89057e.pdf
    • http://mittelmanphotography.com/uploads/1/3/0/4/130483397/zovumagonakuvi_devizekebazav_vamuzowuteg_zejotilubug.pdf
    • http://ubercovers.com/uploads/1/3/0/4/130476605/tujekavefezo.pdf
    • http://nickandnelle.com/uploads/1/3/0/4/130435833/7642976.pdf
    • http://juanitamaude.com/uploads/1/3/0/3/130324386/zaxawadizipofugavik.pdf
    • http://745217932489560.com/uploads/1/3/0/8/130874121/96b03cbc68.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cf4.bin
4a28bc152778bcbb2cde984fdb1c71d5958f60556296e18a7505f557eb81bef7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CF4 8712 bytes
font_01_sfnt_off00009e10.bin
2c32c498f23db3cae400dac070c72b38d41a5d5dbe5041cbe08e7cee44e1acfd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9E10 2648 bytes
font_02_sfnt_off0000a760.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA760 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.