Malicious PDF — malware analysis report

Static analysis result for SHA-256 eae51c0ac5e8f91b…

MALICIOUS

PDF

39.5 KB Created: 2020-06-18 06:41:18 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4c79bebe968eb4861538ffa5095cc0e5 SHA-1: 7241c7b30453cc03556b9cb36dd47179d51f07dd SHA-256: eae51c0ac5e8f91b3bf2b19ea9e284ef767f128690ce4cab4d08f2aefed578a3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or distribution network. The document body contains metadata related to its creation, but no direct user-facing text that would indicate a specific lure. No scripts were extracted from this sample. The primary attack pattern involves directing users to external resources, potentially for SEO manipulation or to serve further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lindentreephotos.net/uploads/1/3/0/8/130873875/130873875.html#acca+f9+study+text+pdf
    • http://thereversecowboy.com/uploads/1/3/0/5/130589320/bfd35.pdf
    • http://peer-stress-survey.com/uploads/1/3/0/9/130969411/5455507.pdf
    • http://blackportholdings.com/uploads/1/3/0/6/130605504/tinatimetamiluvi.pdf
    • http://thebrainyblondemedia.com/uploads/1/3/0/4/130477007/noxufebosofuve.pdf
    • http://latinosandamigos.org/uploads/1/3/0/2/130289292/pakuna_tirakumemomat_tagigoreve_zudopej.pdf
    • http://mail.copperbeechassociates.com/uploads/1/3/0/2/130272928/zotugakeresusi_mulomigusoj_nesotonaxapuj.pdf
    • http://sites.godfrey-lee.org/uploads/1/3/0/5/130589360/pusesuxe-xebaxoliz-daparopa.pdf
    • http://jobsight365.com/uploads/1/3/0/5/130588452/mitader-setuzi-sukapamoduji-pewuduwegedaked.pdf
    • http://alohawraps.co/uploads/1/3/1/4/131453246/duxatu-nevidefutere.pdf
    • http://buildmaui.net/uploads/1/3/1/4/131453402/sinewuzokanex.pdf
    • http://amycourtenay.com/uploads/1/3/0/4/130435690/tuvigasur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c83.bin
a3f1c1e1602b4fd144e55b3d0c4ba98f86504b8ac16b73279d37fb54b9664a5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C83 4952 bytes
font_01_sfnt_off00006d6e.bin
f4523845b7add8f59e6d05b3386e274f82af4b7b6c8bf0bbc50883eafd2025d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D6E 10844 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.