Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8281b6c1691fb0a…

MALICIOUS

PDF

46.1 KB Created: 2020-03-27 12:36:39 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7a7b8d719a6f51afd8db2d75e6e94b36 SHA-1: 42ae19810b3c5897a3de62056e7851f4336ebf5b SHA-256: e8281b6c1691fb0a2073a3de1d48d1a6d7ee33c6f1f3223ab49ffcc6fccb4964
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or distribution mechanism. The document body contains garbled text and some embedded URLs, further supporting the link farm hypothesis. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://winksofroyalty.com/uploads/1/3/0/7/130775742/130775742.html#las+unidades+fundamentales+del+sistema+ingles+son
    • http://mta-sts.mail.tacosmexican.com/uploads/1/3/0/3/130323762/nosodaniku_tebozemetapob_sotonuzap_wileval.pdf
    • http://www.newglasgowmassage.ca/uploads/1/3/0/5/130538862/vefoxane.pdf
    • http://schoolsprouts.com/uploads/1/3/0/5/130589049/wewew.pdf
    • http://donotring.com/uploads/1/3/0/7/130775432/pufodotunanafu.pdf
    • http://neatonrental.com/uploads/1/3/0/4/130488217/957044f.pdf
    • http://sdtranslationcenter.com/uploads/1/3/0/4/130491079/cddcf.pdf
    • http://puppylovepetcarema.com/uploads/1/3/0/3/130379864/pujosopigu.pdf
    • http://mail.rowdygainesmastersclassic.com/uploads/1/3/0/5/130589077/9959046.pdf
    • http://www.hawkinspurdueproperties.com/uploads/1/3/0/9/130969231/ziwufezofalivula.pdf
    • http://splinteredmindprints.com/uploads/1/3/0/6/130604789/4157511.pdf
    • http://lauratokarczyk.com/uploads/1/3/0/9/130969712/dibeluxisu.pdf
    • http://www.lukegnadinger.com/uploads/1/3/0/5/130588973/7595981.pdf
    • http://xivgrams.com/uploads/1/3/1/3/131398488/xuruxupaxuzafo.pdf
    • http://teach101.net/uploads/1/3/0/6/130621646/141820.pdf
    • http://sv-og-erp.de/uploads/1/3/0/7/130775286/7375540.pdf
    • http://miiasoey.com/uploads/1/3/0/7/130738893/zibodejanojal_dudoxe_magodimovo.pdf
    • http://www.galvestonrobots.org/uploads/1/3/0/4/130483045/nosofex.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cf6.bin
40c722e0c41a5ff6c49224468bf442806993ea7b72e7ecf2ef9bad88a7d5c6b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CF6 9236 bytes
font_01_sfnt_off00009de8.bin
26dc621536a723ce4f828ab0ea3c55df8c3992fa4057bb3e7b916f5d65d4560c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9DE8 3048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.