Malicious PDF — malware analysis report

Static analysis result for SHA-256 d3e65f087f9a0ce3…

MALICIOUS

PDF

39.0 KB Created: 2020-04-03 00:08:43 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 640a6b6a238b7ddc88e621ad28290d1d SHA-1: 9709e2b887b57ce90a1b41506c0d12004207fb74 SHA-256: d3e65f087f9a0ce371c1b852508db1b16eb1b4b94903a95c6002516e0b9b7482
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links, many of which are dynamically generated and point to unrelated domains. The document body, though partially obfuscated, references a 'Bose wave radio cd player manual' and includes metadata suggesting it was generated by wkhtmltopdf, indicating a likely SEO link farm or content stuffing tactic. The primary goal appears to be driving traffic to these external sites rather than executing malicious code directly within the PDF.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stratford-hvac.com/uploads/1/3/0/5/130588936/130588936.html#bose+wave+radio+cd+player+manual
    • http://brettmgearing.com/uploads/1/3/1/1/131164424/gawupituvo-vugoladevizu-sevawakaz-zipew.pdf
    • http://madtownrobotics.com/uploads/1/3/0/7/130738603/zebaf-veluwuzok.pdf
    • http://annotalegal.com/uploads/1/3/0/7/130775490/597152.pdf
    • http://truehomeswholesale.com/uploads/1/3/1/4/131453215/8163992.pdf
    • http://airductcleaningexpertsboyntonbeach.com/uploads/1/3/1/1/131164269/7753536.pdf
    • http://earthlodgecenter.com/uploads/1/3/0/7/130775950/7700041.pdf
    • http://pinehillscamp.org/uploads/1/3/0/8/130874435/8916296.pdf
    • http://solarpowermidatlantic.org/uploads/1/3/0/4/130489417/bakutosegonokefa.pdf
    • http://rosswooddesigns.com/uploads/1/3/0/7/130775560/9346923.pdf
    • http://cm-well-done-ltd.com/uploads/1/3/0/6/130604918/8a33c8.pdf
    • http://autodiscover.c3power.org/uploads/1/3/0/6/130621803/jisolaxewawojir.pdf
    • http://charlottehqopportunity.com/uploads/1/3/1/3/131379919/lofabe.pdf
    • http://adagedanceanddrama.com/uploads/1/3/0/8/130874026/1518618.pdf
    • http://adentaitalia.com/uploads/1/3/1/3/131398045/166af80672e2016.pdf
    • http://bigcreekkennels.com/uploads/1/3/0/6/130603709/9805259.pdf
    • http://huckleberryandhoneybee.com/uploads/1/3/1/3/131380725/6586989.pdf
    • http://livraexpress.ch/uploads/1/3/1/3/131380205/totobak.pdf
    • http://alychicken.com/uploads/1/3/0/7/130739202/belaxisedokogog.pdf
    • http://dtaylor88.com/uploads/1/3/1/3/131398215/2307178.pdf
    • http://atelier-fleuris.com/uploads/1/3/0/6/130621223/joniwoworimakibuler.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fe9.bin
b91fae8ba0b361d372d3f6c31e889915c9e3903d2f02a046e141155d3a785528		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FE9 7964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.