Malicious PDF — malware analysis report

Static analysis result for SHA-256 dee3cc2e2608ec57…

MALICIOUS

PDF

39.9 KB Created: 2020-04-17 15:02:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 658a6a93510c22a222ccd999880af2d1 SHA-1: 87dd9c37443e5806982e6dafd18050950d06dbe9 SHA-256: dee3cc2e2608ec571610480e2f5370263c00f03b3b5fd527c3d7ae8c864c2be7
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named and hosted on unrelated domains, indicating a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains references to 'Alif episode 10 pdf free', suggesting a lure to download content. The primary heuristic 'PDF_SEO_LINK_FARM' strongly suggests this is a malicious PDF designed to redirect users to potentially harmful sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://conciergecouriers.com/uploads/1/3/1/4/131408618/131408618.html#alif+episode+10+pdf++free
    • http://octagonconstructioncorp.com/uploads/1/3/0/7/130739456/8000f9ba3e1abec.pdf
    • http://colauttigroup.com/uploads/1/3/1/4/131406046/9e682aa.pdf
    • http://dougdahmvoiceover.com/uploads/1/3/0/6/130604446/8400296.pdf
    • http://besttme.com/uploads/1/3/0/9/130969938/d45ead7b69a.pdf
    • http://trigoy.com/uploads/1/3/0/5/130588451/wumebuwufinetez.pdf
    • http://siriusbrands.com/uploads/1/3/0/5/130590371/limodov.pdf
    • http://dsrgolftournament.com/uploads/1/3/0/5/130589098/6081942.pdf
    • http://danieleporretta.com/uploads/1/3/0/6/130622076/5519575.pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006188.bin
d1d0f710cd5e7b67914567e55e415d16598b409031ed7a1fb0d293d216e08f24		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6188 8168 bytes
font_01_sfnt_off0000811b.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x811B 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.