Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb5b79b76b40c971…

MALICIOUS

PDF

37.1 KB Created: 2020-04-13 03:17:02 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 56c26b85219ec2dce6f524a5b3b85aef SHA-1: f3734999f920ee6756adcc5a12e32b44e6a7a8d4 SHA-256: cb5b79b76b40c97154274ba8f29fb02e0a7e3d55b4742a42acef057e212d03ca
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The document body, though partially corrupted, suggests a lure related to book introductions. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent, pointing to a network of linked domains designed to artificially inflate search engine rankings or distribute malware. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://argentinesociety.com/uploads/1/3/0/5/130588319/130588319.html#como+hacer+introduccion+de+un+libro
    • http://eventsbyemilie.net/uploads/1/3/1/4/131407882/199ba963e56.pdf
    • http://cjlservices.net/uploads/1/3/1/3/131398148/9688861.pdf
    • http://pampanga-properties.com/uploads/1/3/0/5/130590351/f3d5724e5c019.pdf
    • http://moderntabletoprva.store/uploads/1/3/0/7/130738859/tefemotef.pdf
    • http://awiltportfolio.com/uploads/1/3/1/4/131482822/7010731.pdf
    • http://wendellmills.com/uploads/1/3/0/7/130739793/1464556.pdf
    • http://goonmud.com/uploads/1/3/0/5/130588635/4473137.pdf
    • http://homesbycoronado.com/uploads/1/3/0/8/130874198/kowisuvizu.pdf
    • http://jewelry2013.com/uploads/1/3/0/7/130739000/nujasur.pdf
    • http://chrisbartold.us/uploads/1/3/0/6/130620839/bcc3aa27214f03.pdf
    • http://dress2kill.shop/uploads/1/3/0/9/130969027/49e3b98cd8a46.pdf
    • http://imaginecarehealthlab.net/uploads/1/3/1/4/131454719/tuderedawozepar_jesojokumaj_wunejefin.pdf
    • http://abraxasroots.org/uploads/1/3/0/6/130620833/salikulufeguja_vegulu.pdf
    • http://jasondugan.com/uploads/1/3/1/6/131606027/420ef931b6bc.pdf
    • http://balancehealthmanagement.com/uploads/1/3/0/5/130551486/515558.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000068e9.bin
79bfeb467ec0d4b07860900dfbc7d170b9ac330bf9b20fe9907f2d9c309847cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68E9 8100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.