Malicious PDF — malware analysis report

Static analysis result for SHA-256 eb7310ee1ebb2b3b…

MALICIOUS

PDF

45.4 KB Created: 2020-05-30 03:30:48 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 426acc9c08d90428cc336ca9422e790c SHA-1: 1717114885e9321cfbb5dcbff7ced5745de92c51 SHA-256: eb7310ee1ebb2b3b1c95e5c8d8a522cc5ac0f3bd49b3ff9bb74873e251e3252c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for further malicious content. The document body contains metadata related to its creation by wkhtmltopdf, but no direct user-facing text that would indicate a specific lure. The primary attack pattern observed is the mass distribution of external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://man.mediutopia.com/uploads/1/3/0/8/130813612/130813612.html#jojo+bizarre+adventure+games
    • http://uniqueewe.org/uploads/1/3/0/6/130639059/risonunipu.pdf
    • http://reinhartfarm.com/uploads/1/3/0/6/130639801/5b576cabb.pdf
    • http://nikiclickit.com/uploads/1/3/0/8/130873996/pujiwetekedip.pdf
    • http://mysatellitehd.com/uploads/1/3/1/1/131163949/2218659.pdf
    • http://wanigatungapictures.com/uploads/1/3/0/6/130621244/putum.pdf
    • http://theshadowflock.com/uploads/1/3/0/5/130588467/d69cb06a21ee799.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b8d.bin
bbae01c36a636ed80e729dd974b8a75860cc427c97ef0e6f80b9d1c636ea0e21		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B8D 12912 bytes
font_01_sfnt_off0000858c.bin
317fb1f46029478db87cb5d6964bdee13334ecd455904c4eca8bc0751682c6aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x858C 11172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.