Malicious PDF — malware analysis report

Static analysis result for SHA-256 e87bbfac4d7478f8…

MALICIOUS

PDF

53.1 KB Created: 2020-03-27 02:32:12 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4548a121047fc322139e45e5f8cad24f SHA-1: 923596123a72f0b2d664c58deb5395a531a8d057 SHA-256: e87bbfac4d7478f8f5f6ea664ca8f97e26d36772cd6617a14b9dc589b4d77f82
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a mass external link farm, with numerous URLs pointing to PDF files on various domains. The document body text, though partially obfuscated, includes a URL that is also present in the heuristics. This suggests a tactic to drive traffic to a network of potentially malicious sites, possibly for SEO manipulation or to host further malicious content. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://strigiformae.net/uploads/1/3/0/7/130775737/130775737.html#tratamiento+del+quiste+de+erupcion+dental
    • http://lateniteyoga.com/uploads/1/3/0/8/130874043/9285954.pdf
    • http://alstart.co.uk/uploads/1/3/0/7/130738825/wenujijojesomej.pdf
    • http://thehometeamhomecarellc.com/uploads/1/3/0/8/130874510/5782776.pdf
    • http://rscrystalmedicine.com/uploads/1/3/0/6/130620439/8573954.pdf
    • http://bainbridgeip.com/uploads/1/3/0/2/130271113/xederinak-gotixoxal-repaja-zaxivupuvo.pdf
    • http://memadejewelry.com/uploads/1/3/0/6/130621483/5100152.pdf
    • http://midwestmusclebullyclub.com/uploads/1/3/0/6/130604525/nijadut-xivizetokajarof.pdf
    • http://theestheticsstudioonline.com/uploads/1/3/0/5/130543653/gawekux.pdf
    • http://refreshingoasis.org/uploads/1/3/0/5/130550796/nevisuzarofi-luwevaj.pdf
    • http://firedamage-attorneys.com/uploads/1/3/1/0/131069839/4688822.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008be2.bin
638718d9b8fba2dfa35ba1047815a69513cf9d28905519fb39a2c5e09e10d456		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8BE2 11108 bytes
font_01_sfnt_off0000b047.bin
b6fc91563ab5a7032245b86a7db5c78dbd78a0b8380486ac208123baec0fd0c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB047 16104 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.