Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbb7707bec665a2b…

MALICIOUS

PDF

47.5 KB Created: 2020-03-29 11:05:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3a95ab79c0ad59cc877e5f0103996941 SHA-1: 2891d94e42768ea68e6241363bbeab652f20876b SHA-256: cbb7707bec665a2b40bf83a5096589c6e0a2b927bbb57e7334d66ea0d63c3c07
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO poisoning tactic. One prominent link points to a page titled 'financial statement analysis and valuation 4th edition ebook', which is likely a lure to disguise malicious intent. The presence of numerous PDF links further indicates an attempt to drive traffic to potentially compromised or malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-77-223.mgwnet.com/uploads/1/3/1/1/131163536/131163536.html#financial+statement+analysis+and+valuation+4th+edition+ebook
    • http://vnandusimmigration.com/uploads/1/3/0/2/130289504/c3d72a014f983.pdf
    • http://tlcskilledcareinc.com/uploads/1/3/0/6/130622042/wunirotuwerupo.pdf
    • http://zendoctor.org/uploads/1/3/0/6/130604193/8463609.pdf
    • http://examiningkennan.com/uploads/1/3/0/5/130543766/donesetujalov.pdf
    • http://venturarvrentals.com/uploads/1/3/0/3/130323733/xikuvuwemetafafikoj.pdf
    • http://hostmaster.soulpilates.co.uk/uploads/1/3/0/4/130488288/9335751.pdf
    • http://livingstonfamfarms.com/uploads/1/3/0/6/130603676/9561459.pdf
    • http://theflyshed.com/uploads/1/3/0/4/130483550/63833.pdf
    • http://ignitephotobooths.com/uploads/1/3/0/8/130813461/1982327.pdf
    • http://timmhackett.com/uploads/1/3/0/4/130483045/d7001d3678441.pdf
    • http://everdreambuilders.net/uploads/1/3/0/8/130874493/5248058.pdf
    • http://www.kissdrilling.com/uploads/1/3/0/4/130475992/rojojojovorafijit.pdf
    • http://southsideedu.net/uploads/1/3/0/6/130620670/fbd7def.pdf
    • http://www.sweetwatermanors.com/uploads/1/3/0/6/130604030/2a616bf.pdf
    • http://www.leadershipacademyutah.com/uploads/1/3/0/4/130488694/63c16f.pdf
    • http://sunitajoseph.org/uploads/1/3/0/3/130313188/turuxugosoxorod-busej-butilaf.pdf
    • http://www.brynnviar.com/uploads/1/3/0/8/130814106/8939246.pdf
    • http://romyfoto.com/uploads/1/3/0/4/130436147/suladuwas.pdf
    • http://dnaelectrical.info/uploads/1/3/0/2/130271226/gogoluvidok_voravitu.pdf
    • http://cacondon.com/uploads/1/3/0/2/130271126/4686303.pdf
    • http://psinco.com/uploads/1/3/0/7/130739180/8541281.pdf
    • http://lionglassandwindowservices.com/uploads/1/3/0/7/130775987/vesunipus-tawiro.pdf
    • http://maxhardwoodfloors.com/uploads/1/3/0/8/130814004/kupemovo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000090ad.bin
4a534e8685a483a1211a6ce017047c2ef1364ea8ce4c0d3cd7a6ce0dfece0cc3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x90AD 8028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.