Malicious PDF — malware analysis report

Static analysis result for SHA-256 e83c79d57cc79a9a…

MALICIOUS

PDF

44.5 KB Created: 2020-04-12 04:02:09 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 47b0921f78ef404bffbe3ebec9ba3171 SHA-1: 20416b34c0f85b697d7234dc1e61bd6ee33c75b3 SHA-256: e83c79d57cc79a9a048910d8807a56e0472780888d03d7a987d2e9a790b436bb
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO abuse tactic. The document body contains text related to 'Ap world history strayer chapter 17' and application metadata, which appears to be a lure to disguise the malicious intent. The primary heuristic 'PDF_SEO_LINK_FARM' indicates the file's purpose is to host a mass of external links, likely to malicious or spam content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thesoonernetwork.com/uploads/1/3/1/0/131071309/131071309.html#ap+world+history+strayer+chapter+17
    • http://gamercharity.com/uploads/1/3/0/7/130775383/vabopopi.pdf
    • http://schonerdanschoon.nl/uploads/1/3/0/3/130379289/5180c238aa.pdf
    • http://meridenoildeliveries.com/uploads/1/3/0/7/130776096/741a5822c0a4aa.pdf
    • http://wevebeentoopatient.com/uploads/1/3/1/4/131453436/5610403.pdf
    • http://terraverdesolutions.net/uploads/1/3/1/1/131164555/nasotuladuwu.pdf
    • http://farmtruckslens.com/uploads/1/3/1/4/131406295/7986428.pdf
    • http://bravogolfaviation.com/uploads/1/3/0/6/130621801/rodimofifuvofi.pdf
    • http://enzymeforce.com/uploads/1/3/1/3/131383301/jisetanolu-wepipavane-gexutosexevukir.pdf
    • http://riverandrockexpeditions.com/uploads/1/3/0/8/130814631/sikoje_vuzuwupusono.pdf
    • http://wadessmokinbarbecue.com/uploads/1/3/0/3/130313746/0bffd5ee9.pdf
    • http://laurencarr1.com/uploads/1/3/0/7/130738596/9810647.pdf
    • http://foto-en-zo.org/uploads/1/3/0/6/130639971/xobubopoposa.pdf
    • http://terraverd
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cf3.bin
9370dde62bf9638a696684aafe55126e249e23aa0fed473f635a1a0c7c25b874		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CF3 1712 bytes
font_01_sfnt_off00008512.bin
c383a910ba44dc6adedee5373e41edb15d0a5766619099906d507eaa1d9a2e59		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8512 7992 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.