Malicious PDF — malware analysis report

Static analysis result for SHA-256 da9f755eb3915d04…

MALICIOUS

PDF

33.4 KB Created: 2020-04-05 05:47:30 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8c090a1a2b3143724ab46ee87f014b9f SHA-1: ff815d6bdb114cabf3c58c9855815d1414d0c263 SHA-256: da9f755eb3915d04e590167564ef41b627c9e961d7f5d943cc31acba3062da39
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which appear to be generated for SEO purposes. The document body, though partially corrupted, contains text related to a dictionary and the authoring application, suggesting a lure to disguise the malicious intent. The primary heuristic indicates a 'PDF_SEO_LINK_FARM', suggesting the document's purpose is to link to numerous external sites, likely for malicious redirection or SEO spam. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://allegroacademy.net/uploads/1/3/0/7/130775537/130775537.html#diccionario+rae+online+sinonimos
    • http://agiletwincities.org/uploads/1/3/0/4/130435524/kireli-kuluwumadiken-zatulozonedew.pdf
    • http://proautocareers.com/uploads/1/3/0/8/130873947/2055292.pdf
    • http://zpetitpacket.com/uploads/1/3/0/6/130639805/7542885.pdf
    • http://kiwango.fr/uploads/1/3/0/7/130775181/3a658c532.pdf
    • http://ntcchurchandschool.com/uploads/1/3/0/2/130291491/viwutu.pdf
    • http://kelsistoltenow.com/uploads/1/3/0/7/130775045/2175933.pdf
    • http://mammothtasks.com/uploads/1/3/0/7/130775596/2309874.pdf
    • http://urbanninjagear.com/uploads/1/3/1/4/131453232/wetenepeweza-gaferozaf.pdf
    • http://tedxkarlovackagimnazija.com/uploads/1/3/1/0/131069875/4469.pdf
    • http://lfoto.net/uploads/1/3/0/7/130776485/wudisufab_winokebenege_ludabutebir.pdf
    • http://thymeandtansy.com/uploads/1/3/0/6/130604289/dexuxem-dusanebuxetif-kuxusamav-dutejalonuz.pdf
    • http://dio-training.com/uploads/1/3/0/2/130272629/zunew-mogelopovimibij-kuxisatemis.pdf
    • http://postmodernpostmentaleskimo.com/uploads/1/3/0/3/130323120/44d5c7d8.pdf
    • http://rallypicosdeeuropa.com/uploads/1/3/0/2/130270885/15f3cb51eea059.pdf
    • http://snaptravelchew.com/uploads/1/3/0/7/130776558/vutog_jewelitiwo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005938.bin
2d7332c1f7e50129e2f7318216a11218fc28fc6753825ccb3196ea281575f67e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5938 8060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.