Malicious PDF — malware analysis report

Static analysis result for SHA-256 c9734b11eef5fd05…

MALICIOUS

PDF

44.8 KB Created: 2020-04-13 16:49:58 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 45527eb0e64642b4a3d995c6316b7cc4 SHA-1: 3b0b6403eea4d75ab611a8852337f74d13f0b589 SHA-256: c9734b11eef5fd0597435b2943a4e7f8315a2b560691cdf088baa03e7849acd0
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links, many of which point to similarly structured URLs on different domains. This pattern is indicative of a link farm or SEO spam campaign, designed to drive traffic to various sites. The document body, though partially corrupted, contains a reference to a game guide, suggesting a lure to attract user clicks. No scripts were extracted, limiting the analysis of direct malicious actions.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://getadigger.com/uploads/1/3/0/6/130604355/130604355.html#fury+warrior+pve+guide+wotlk
    • http://hookahdaddy.net/uploads/1/3/0/5/130538875/454f1e89.pdf
    • http://easywebsiteoptimization.com/uploads/1/3/1/1/131164198/d32895630755.pdf
    • http://thecreativetherapists.com/uploads/1/3/1/6/131606348/177804.pdf
    • http://muchacomida.org/uploads/1/3/0/2/130272385/9712982.pdf
    • http://www.mothlights.com.au/uploads/1/3/0/9/130969959/e3cb1c9797be9.pdf
    • http://thetwospiritsband.com/uploads/1/3/1/0/131070146/a6be93a8a1b.pdf
    • http://f99-gc.com/uploads/1/3/0/6/130620956/dirafemirili-tejakagar.pdf
    • http://turkeycreekretrievers.com/uploads/1/3/0/6/130605349/rofavekepu.pdf
    • http://serenitycosmetcidental.com/uploads/1/3/0/4/130436096/5e4a5a02b.pdf
    • http://justjesusacm.com/uploads/1/3/1/3/131380908/ff6d687c9e73.pdf
    • http://tortoiseconservation.net/uploads/1/3/0/5/130539091/matupefatije.pdf
    • http://sightlux.info/uploads/1/3/0/7/130775545/pivagekosodija-zamatanon.pdf
    • http://gulphin.com/uploads/1/3/1/4/131407445/fejunodanuladix.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008531.bin
73d0fa80304347109c1dd4d3413f5896a0063e02cb5c2a49778a6a0b255a45f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8531 9168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.