Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea62af4e9bd3dec3…

MALICIOUS

PDF

70.7 KB Created: 2020-03-30 13:44:20 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7aa095467009f9c651056f408e114506 SHA-1: 9299fb4ffd465b468405d9f5837871849d3a8c24 SHA-256: ea62af4e9bd3dec3033715eb050761e56e0929cafef31b89d13825d94cb4a1ac
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to similarly structured URLs on different domains. This suggests a link farm or SEO spam campaign. One of the embedded URLs, http://74-123-76-212.mgwnet.com/uploads/1/3/0/6/130620313/130620313.html#unidad+de+energia+sistema+ingles, is directly referenced in the document body. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-76-212.mgwnet.com/uploads/1/3/0/6/130620313/130620313.html#unidad+de+energia+sistema+ingles
    • http://abconcreteptyltd.com/uploads/1/3/0/7/130775440/4e63f74199c24.pdf
    • http://beautybyksade.com/uploads/1/3/0/2/130289603/timajarewexur_pegilosuve.pdf
    • http://haircarebykylee.com/uploads/1/3/0/7/130775570/40062da.pdf
    • http://withlovemilka.com/uploads/1/3/0/5/130539659/5505552.pdf
    • http://perlustrate.org/uploads/1/3/1/3/131384468/ridumizadoloz.pdf
    • http://drkeiradc.com/uploads/1/3/0/8/130814605/vetagomu.pdf
    • http://madisonurbanhuntingclub.com/uploads/1/3/0/9/130969362/55ea51644ec4a.pdf
    • http://davisproductdesign.com/uploads/1/3/0/6/130605324/c0db530a9.pdf
    • http://missrkiernan.com/uploads/1/3/0/4/130478609/aa375214ae1bc.pdf
    • http://cochraneresearchinstitute.org/uploads/1/3/0/6/130621689/5115113.pdf
    • http://keeganendeavor.com/uploads/1/3/0/4/130436299/mesizixisabutu.pdf
    • http://tournoidevignoles.com/uploads/1/3/1/0/131070798/mavawarujej.pdf
    • http://karraschconsulting.com/uploads/1/3/0/7/130739479/6810760.pdf
    • http://angelannette.com/uploads/1/3/0/4/130483953/6300a42c0419.pdf
    • http://clintonflowershopofnewyork.com/uploads/1/3/0/4/130488197/8049820.pdf
    • http://midland-fox.com/uploads/1/3/0/7/130739387/aabb13b5d1994.pdf
    • http://knead-massage.services/uploads/1/3/0/5/130588601/nopabil.pdf
    • http://sahalla.com/uploads/1/3/0/2/130287984/1712132.pdf
    • http://inkyartists.com/uploads/1/3/0/6/130639936/pojifopuwarakon.pdf
    • http://madmulefitness.com/uploads/1/3/0/2/130289266/1353184.pdf
    • http://delmontesupport.com/uploads/1/3/0/2/130291449/lupomazaruzakajunebe.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d7ac.bin
21a9e846584d6871025d911f00125e9f6091d2f4159e49db3dd7322b2b62d3fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD7AC 10340 bytes
font_01_sfnt_off0000fba6.bin
25f83a87302cc7403ac55257ca61ed34fca3279596967d0ff9c6b4ab1b27b9c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFBA6 4404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.