Malicious PDF — malware analysis report

Static analysis result for SHA-256 cba642f7d2e49704…

MALICIOUS

PDF

44.3 KB Created: 2020-04-14 05:58:28 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3c1cb59b451504fac5fcf619385f77bc SHA-1: 65630810bf5d4f4335b5e4e909713e487eeb0d6f SHA-256: cba642f7d2e497045a6046c4fb90d440a10b7e1009d04c52be5e04fd5ecf868c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which point to other PDFs hosted on similar domains. This behavior is indicative of a link farm or a mechanism to distribute further malicious content. The document body, though heavily obfuscated, contains a URL that appears to be the primary lure. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nickersonenterprises.net/uploads/1/3/0/4/130477979/130477979.html#business+model+generation+template+excel
    • http://scientificsign.com/uploads/1/3/0/8/130813428/9787446.pdf
    • http://musicflowmedia.net/uploads/1/3/0/5/130543154/9184487.pdf
    • http://annapontel.com/uploads/1/3/1/4/131406269/92f80c.pdf
    • http://reminiscence-film.fr/uploads/1/3/0/7/130738482/f4a9346cf.pdf
    • http://joinhomesmartnow.com/uploads/1/3/1/3/131398091/vefelibaradororabo.pdf
    • http://cfwallace.com/uploads/1/3/0/4/130435962/8390776.pdf
    • http://mylesmccallum.com/uploads/1/3/0/5/130550654/1390972.pdf
    • http://clayocomedy.com/uploads/1/3/0/5/130550887/junis.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006642.bin
47fd63d5c346fdcaf8245d7276301736a8171a51209d1ad112b5112466e2dc60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6642 8060 bytes
font_01_sfnt_off0000854a.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x854A 2652 bytes
font_02_sfnt_off00008eb2.bin
1d1fa5121415f8f5353993473374918b9d2a38f433752094af4cce5d3be72c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8EB2 16312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.