Malicious PDF — malware analysis report

Static analysis result for SHA-256 e301d344d4b51cba…

MALICIOUS

PDF

37.9 KB Created: 2020-04-02 02:22:44 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9294142e4515d3f75c08018c95a62cb7 SHA-1: 4bccf94b69c48ff3ee958dcf0e71d5537b29e6a1 SHA-256: e301d344d4b51cba948d0d1b18bb79e550bdcfdd96778f64e3ab7ea000d1be79
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, includes a URL that points to a page about regulating a car carburetor, suggesting a lure. The primary function appears to be directing users to a network of linked PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southernholdinggroup.com/uploads/1/3/1/4/131454731/131454731.html#como+regular+el+carburador+de+mi+auto
    • http://flawlessedinburgh.com/uploads/1/3/0/9/130969553/4cb3604a15.pdf
    • http://draw4funwithkevin.com/uploads/1/3/0/7/130775842/varab_savemuwabemiza.pdf
    • http://entirely-possible.com/uploads/1/3/1/1/131163550/aa9445ba2eb.pdf
    • http://ecopoobags.com/uploads/1/3/0/6/130604730/serew.pdf
    • http://azaniaradio.com/uploads/1/3/0/9/130969496/kizawuxonofonaru.pdf
    • http://timelessteesh.com/uploads/1/3/0/2/130288321/cdaf89994643d6.pdf
    • http://alexknutsonart.com/uploads/1/3/0/6/130604349/51358fb2745e1.pdf
    • http://creepycrittersrescue.org/uploads/1/3/0/2/130272930/8732013.pdf
    • http://webuyhouses24x7.com/uploads/1/3/0/2/130273983/16dd0.pdf
    • http://mycommediadellarte.com/uploads/1/3/0/5/130588584/7855649.pdf
    • http://spinorth.net/uploads/1/3/0/6/130639563/8244872.pdf
    • http://businesscreator.net/uploads/1/3/0/7/130738679/fanixuxenawesubol.pdf
    • http://colganpowerprogram.com/uploads/1/3/0/4/130478648/zazotutavowizezitos.pdf
    • http://habbovs.com/uploads/1/3/0/7/130738511/9f7ad.pdf
    • http://interversetech.com/uploads/1/3/1/4/131405948/3437746.pdf
    • http://studiokirbyartistry.com/uploads/1/3/0/6/130639273/ba7fb962b2fd8e.pdf
    • http://pgactivatorsociety.org/uploads/1/3/0/7/130775722/10904.pdf
    • http://la-jynne.com/uploads/1/3/0/2/130289339/4152909.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006c6b.bin
8ce17320c405031d56fb0de50e2dcb7ecf8a505962c5c5d7dabca02a1a219284		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C6B 8120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.