Malicious PDF — malware analysis report

Static analysis result for SHA-256 daf109826eb45209…

MALICIOUS

PDF

42.7 KB Created: 2020-05-03 11:58:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 65fd3b06fc8f210ad91ee36e8741f721 SHA-1: 929dec7450b2fafcc23bdff5cc00ef506610e65a SHA-256: daf109826eb452096f686821216a03efde9ea10f9a2a0e03f0cbc1df104d8daa
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, a technique often used for SEO spam or to redirect users to malicious sites. The document body, though partially corrupted, suggests a lure related to educational worksheets. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates a link farm strategy, aiming to manipulate search engine rankings or distribute traffic to various domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jmsst2.com/uploads/1/3/1/6/131636682/131636682.html#distributive+property+worksheets+for+6th+graders
    • http://autooutsource.com/uploads/1/3/0/4/130436492/3382492.pdf
    • http://teboxretail.no/uploads/1/3/0/9/130969375/d63701c35a1363.pdf
    • http://palivillage.com/uploads/1/3/0/4/130476908/jupuxeletuwufa-nolalapovebim.pdf
    • http://northshorecleaners.net/uploads/1/3/0/4/130483864/defiwoxo_bipekanuxizobu_xakojibanemal.pdf
    • http://gregmatsumoto.com/uploads/1/3/0/5/130539679/fimobakudokimu_paxisim_sotenigulora_fonojirigamoba.pdf
    • http://nadiafarah.com/uploads/1/3/0/7/130775685/lejemazij_biziwa.pdf
    • http://topcincinnatibeautysalontraining.com/uploads/1/3/0/6/130620715/vofife.pdf
    • http://manushsciencetechnologies.com/uploads/1/3/0/7/130739288/xomiferamukevuz.pdf
    • http://internationalcenterformeditation.com/uploads/1/3/0/6/130620677/leval.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006401.bin
4764d17d6248233119bb36c8c5378b16e3dc918981541a36471dcedd2a277970		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6401 10796 bytes
font_01_sfnt_off00008952.bin
de5e424296fca6632de503ebef56d41c9898c13bba2aba3354ff7f3c3578a82d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8952 16116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.