Malicious PDF — malware analysis report

Static analysis result for SHA-256 df42fe35b41fff54…

MALICIOUS

PDF

33.3 KB Created: 2020-04-09 20:03:46 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 528ca1fe968105a8669c4bcdb2454b28 SHA-1: 2217ce319521c60f2ce294d6e447da517b9509fb SHA-256: df42fe35b41fff54caf54457857e901df3242b7b91e6ede32b99daf7fc00c6ba
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are numerically or generically named PDFs hosted on various domains. The document body mentions 'Husky pro air compressor parts list', suggesting a lure to attract users to these linked sites. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to host malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jensokolfitness.com/uploads/1/3/1/4/131454262/131454262.html#husky+pro+air+compressor+parts+list
    • http://avavilihughes.net/uploads/1/3/1/4/131437656/9522564.pdf
    • http://tryoungcrew144.com/uploads/1/3/0/6/130605279/3043003.pdf
    • http://urfacefix.com/uploads/1/3/0/6/130621654/kupunubamufat.pdf
    • http://uceplus.com/uploads/1/3/0/5/130542734/af234390674f731.pdf
    • http://cbcurrie.com/uploads/1/3/0/9/130969369/66e2c00a706a7e.pdf
    • http://sportsisland.org/uploads/1/3/0/2/130270966/kizapex-pevaveso-jimegadotup.pdf
    • http://starttofocus.com/uploads/1/3/0/5/130545429/nejewovisidoxe_rokonemu.pdf
    • http://klzfarmboyz.com/uploads/1/3/0/9/130969476/gokekusesove_zigobize_damagipeja_kenulazerurega.pdf
    • http://mzteachuh.com/uploads/1/3/1/0/131070045/851dd.pdf
    • http://ballinfitness.com/uploads/1/3/0/2/130291328/kajevegib.pdf
    • http://homesandpastures.com/uploads/1/3/0/3/130313057/mevejetelefixobig.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000058b3.bin
fd418e7876faadafafca6804a5562a8a331f72c115b5d950ec6f63dc01fac51a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58B3 8280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.