Malicious PDF — malware analysis report

Static analysis result for SHA-256 da2db4cf8884d4e9…

MALICIOUS

PDF

41.2 KB Created: 2020-03-27 05:00:38 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 652b37cbb7bc502a1a53353cb8fd40c8 SHA-1: 8801a09b042d5a30e381918d286a2826d5fc2073 SHA-256: da2db4cf8884d4e93040ea5ca51f8eed741cb15d271e8f0152b7058c38facfb4
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was generated by wkhtmltopdf and contains a large number of embedded external links, triggering the PDF_SEO_LINK_FARM heuristic. One of these links, http://uccarticles2and9.net/uploads/1/3/0/5/130544725/130544725.html#honeywell+lyric+t5+wiring+diagram+heat+pump, is also flagged as an embedded URL. This suggests a link farm or SEO poisoning attack, where the document's primary purpose is to redirect users to potentially malicious external sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://uccarticles2and9.net/uploads/1/3/0/5/130543466/130543466.html#honeywell+lyric+t5+wiring+diagram+heat+pump
    • http://reikiologie.net/uploads/1/3/0/8/130814178/jadakoliwi-tuzisimixetile-vusukoxapikiwa.pdf
    • http://inyago.org/uploads/1/3/0/9/130969016/xosenigeb_retubilanumobon_wemomogeda.pdf
    • http://www.hardbodyathletics.org/uploads/1/3/0/6/130603928/musuwitanuwiv.pdf
    • http://firstmelissa.org/uploads/1/3/0/3/130313854/bemuzuvafenam.pdf
    • http://wingfactorycafeusa.com/uploads/1/3/0/3/130313398/kuxopulol.pdf
    • http://commonprojectla.com/uploads/1/3/0/7/130738975/515c102909b.pdf
    • http://my-medicare-insurance.com/uploads/1/3/0/6/130604807/degutapozezatuja.pdf
    • http://bartonpool.net/uploads/1/3/0/5/130544725/wurovalum-popivejeno-milufotez.pdf
    • http://corenewal.org/uploads/1/3/0/5/130551198/ruwujuta-zaveko-vunim.pdf
    • http://www.mercelliofficial.com/uploads/1/3/0/4/130435892/f9206d9c0e8fe30.pdf
    • http://elotech.org/uploads/1/3/0/3/130323630/1857497.pdf
    • http://www.oprovision.org/uploads/1/3/0/7/130739164/sujesarexivavil-wefonuz.pdf
    • http://gsfx.org/uploads/1/3/0/5/130540714/2f6cdc17b51e.pdf
    • http://boccon-gibod.org/uploads/1/3/0/5/130542755/wovozove-rewosemu.pdf
    • http://keircarpentry.com/uploads/1/3/0/8/130874386/9779570.pdf
    • http://www.cosyndpro.com/uploads/1/3/0/8/130874648/suwenewemomeladavuw.pdf
    • http://cafecancunco.us/uploads/1/3/0/2/130270832/ed746a7861e4c1.pdf
    • http://ravispice.com/uploads/1/3/0/5/130590583/guvupupavixena-bopovudino-talamuxud-muzuloxupifu.pdf
    • http://nutrients.supply/uploads/1/3/0/8/130874533/8069344.pdf
    • http://buteykobreathingeducator.com/uploads/1/3/0/6/130604815/5484702.pdf
    • http://receptivefieldvfx.com/uploads/1/3/0/6/130620522/afb2e.pdf
    • http://gabrielelaw.com/uploads/1/3/0/4/130488786/zomaxedawegawavulus.pdf
    • http://www.jesskaphotography.com/uploads/1/3/0/6/130604788/9600567.pdf
    • http://ramsdale.online/uploads/1/3/0/6/130620399/gifed.pdf
    • http://feenomenalmoms.com/uploads/1/3/0/6/130603977/389d08.pdf
    • http://www.jesskaphotography.com/uploads/1/3/0/6/1306047
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007668.bin
c44a0e0c4debe28aeb29c3488f858ef3e670dbbed37d834dfc2fe7f21e39fff3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7668 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.