Malicious PDF — malware analysis report

Static analysis result for SHA-256 e2421a8ddfadd398…

MALICIOUS

PDF

42.6 KB Created: 2020-03-30 16:19:47 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 57901e9f9b7ea4bffccf7895ed23992f SHA-1: fc1dac3e6b9dc63b9a70cdd40169dbb719661f6f SHA-256: e2421a8ddfadd398728a992fc527a708e62fc7cbf2b0bddc1665ac2ead0184d1
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that is also listed among the extracted URLs. This suggests the primary purpose of the PDF is to act as a link farm, potentially for SEO manipulation or to distribute further malicious content via the linked PDFs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mx.letiziaiannaccone.com/uploads/1/3/0/6/130604635/130604635.html#linea+de+produccion+en+una+empresa
    • http://commercialadvisornetwork.org/uploads/1/3/0/6/130603907/2310675.pdf
    • http://upatuga.org/uploads/1/3/0/4/130435842/b709351b3155.pdf
    • http://artzweig.com/uploads/1/3/0/5/130551625/molinisusejawumu.pdf
    • http://adimef.com/uploads/1/3/0/7/130776385/02caea58486a0.pdf
    • http://sunburstmusic.org/uploads/1/3/0/5/130551378/f644721b8cc546.pdf
    • http://peaceandlovegranola.net/uploads/1/3/0/4/130435833/6779836.pdf
    • http://stylednshotbytb.co/uploads/1/3/1/4/131436956/809cfcf509cf.pdf
    • http://jmshawnee-mls.com/uploads/1/3/0/2/130287934/e266e7693.pdf
    • http://whatthehulla.net/uploads/1/3/0/9/130970008/mexaxisoveg.pdf
    • http://companionservicesllc.net/uploads/1/3/0/3/130312976/d093d440566.pdf
    • http://msmariecrafts.com/uploads/1/3/0/8/130874266/xepixenixan.pdf
    • http://bright-side-painting.com/uploads/1/3/0/4/130476171/zifazal_jolagerororirag.pdf
    • http://givinghomes.net/uploads/1/3/1/3/131383323/669469.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007c3d.bin
364e0acefb7ed28fdf98d842bcec3fd37675a9f9633bc9053d93a130c32f153f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C3D 8644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.