Malicious PDF — malware analysis report

Static analysis result for SHA-256 dead94c44d6c481e…

MALICIOUS

PDF

43.6 KB Created: 2020-05-06 16:24:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 74d1efa59ae9e8c148b4ba7073df656d SHA-1: a7e9bb267b44f816c6f37f6fc75adf332978ee28 SHA-256: dead94c44d6c481e37b469f87376dc7a807d42209c875600fa356d46fcf16072
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains numerous external links, a technique often used in SEO poisoning to manipulate search engine rankings. The document body, while obfuscated, contains URLs that appear to be part of a link farm, directing users to other PDF files hosted on various domains. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent. No scripts were extracted, limiting the analysis to the document structure and embedded links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hinterlandtreeservicesbyronbay.com/uploads/1/3/0/6/130640198/130640198.html#cute+weekend+itinerary+template
    • http://cartoonsbysarah.com/uploads/1/3/1/3/131398332/46ff2fb75a8a80.pdf
    • http://ritamarkwell.net/uploads/1/3/0/3/130313000/tolijukikenub.pdf
    • http://paulmarr.com/uploads/1/3/1/1/131163902/fenex_malur_bifujugug_gofasatizekozi.pdf
    • http://highlandrimpropertiesllc.com/uploads/1/3/1/6/131606835/mogirubanar_jipixafubawel.pdf
    • http://onedreamacademy.org/uploads/1/3/0/2/130289690/nevaputo.pdf
    • http://freeflowgf.com/uploads/1/3/0/7/130775743/seriv.pdf
    • http://othersideworldwide.com/uploads/1/3/0/7/130738801/7778837.pdf
    • http://jenn4judge.com/uploads/1/3/0/7/130738541/gelakafuveweko.pdf
    • http://coastalfloorsde.com/uploads/1/3/0/6/130604247/vasivifomumomuv.pdf
    • http://arkabargrazing.com/uploads/1/3/0/2/130291694/dazuvi_zoxalizumap_zalotovado_delanulubebe.pdf
    • http://lvcellc.com/uploads/1/3/0/4/130476089/7886517.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080c0.bin
aaff71ec4f138431e8e73c43b7b0f1103d9b614427dcac8fed841f54fb51e538		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80C0 10508 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.