Malicious PDF — malware analysis report

Static analysis result for SHA-256 c8d4c4e59e66bea0…

MALICIOUS

PDF

44.2 KB Created: 2020-03-20 02:54:46 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7227bfda0667784c862e5322fdb216d6 SHA-1: 8bdb761097db89830d4f7027346b451fa3fe898b SHA-256: c8d4c4e59e66bea0dbeeb9de44b8d7d6674f282ca00a60f7c7bc6fd517eea887
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, suggests a theme related to radio script elements. The primary attack pattern appears to be SEO spam or a link farm, directing users to numerous external PDF files hosted on various domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ajakchinger.info/uploads/1/3/0/4/130476944/130476944.html#elementos+de+un+guion+radiofonico+y+sus+funciones
    • http://ngworkcoverconsulting.com.au/uploads/1/3/0/2/130272340/ce52d6b0dbced.pdf
    • http://52ohms.org/uploads/1/3/0/2/130289359/fajilutuxedamer.pdf
    • http://horncomb.com/uploads/1/3/0/4/130489417/32e07414d71bd0.pdf
    • http://kidsciencenews.net/uploads/1/3/0/6/130604824/ruroxokize.pdf
    • http://tjsfitness.org/uploads/1/3/0/5/130541023/vatonanejoso-fimabi-fejipuvojibo.pdf
    • http://btkskraedder.com/uploads/1/3/0/6/130622049/ratexemagiwutetapimi.pdf
    • http://www.misscarladance.org/uploads/1/3/0/7/130739437/3622214.pdf
    • http://refuelledbybbfcafe.com/uploads/1/3/0/7/130740186/3983019.pdf
    • http://www.ablossominglifeec.org/uploads/1/3/0/9/130969645/nataxifeti.pdf
    • http://drdenisemlowe.net/uploads/1/3/0/5/130540021/kimemopot-felamatuzuzi-finogivez-nijit.pdf
    • http://garysresume.com/uploads/1/3/0/3/130313404/c2b2b027b0e3c.pdf
    • http://www.birdonawirestudio.com/uploads/1/3/0/5/130543468/1537439.pdf
    • http://www.paulgibsonhypnosis.co.uk/uploads/1/3/0/5/130588798/1961321.pdf
    • http://buycbdoils4less.com/uploads/1/3/0/8/130874127/9576769.pdf
    • http://myjamesandrews.com/uploads/1/3/0/4/130477839/sanutuxiviz.pdf
    • http://hostmaster.thefuzzymole.com/uploads/1/3/0/4/130488265/xatupexafose.pdf
    • http://www.ronswalktalks.com/uploads/1/3/0/2/130287735/sukuz_parisifagu.pdf
    • http://tombloomkarate.net/uploads/1/3/0/5/130545895/dozok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080d1.bin
d1d89f08a0574a3df23fdfe155468e6f32c30e6bce9c6e65494d8510ac86e697		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80D1 9204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.