Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec8cc56751c79228…

MALICIOUS

PDF

37.2 KB Created: 2020-04-11 10:14:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6b72593f35b920c432d5d1f9a3f73abc SHA-1: b0c8e0c219bcba1116ae46e759315315bb321d38 SHA-256: ec8cc56751c79228f24c7a97efbc74572171b351cf2f4da7ef48a9ff5cdf26fd
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are numerically or generically named and hosted on unrelated domains, indicating a link farm or SEO poisoning tactic. The document body, though partially corrupted, suggests a lure related to a 'Hp plotter t610 service manual'. The primary attack pattern involves redirecting users to these external URLs, which are likely malicious or lead to further compromise.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mindforyouth.org/uploads/1/3/0/6/130639397/130639397.html#hp+plotter+t610+service+manual
    • http://abrolhoslandscaping.com.au/uploads/1/3/0/8/130874339/5644918.pdf
    • http://christinewallphoto.com/uploads/1/3/1/4/131438180/wujorapobuw.pdf
    • http://pplemacbook12laptop256gb8gbjune2017rosegold.com/uploads/1/3/1/4/131408516/eca2a0adf44.pdf
    • http://emontra.com/uploads/1/3/0/5/130590613/sezifisejowep-goguvutojidi-xuvufib-vazuza.pdf
    • http://sweetonketobakery.com/uploads/1/3/1/4/131453850/bixozovedasize.pdf
    • http://deckbuilderswinnipeg.com/uploads/1/3/0/7/130776037/b70c7e85.pdf
    • http://law-isaac.com/uploads/1/3/0/8/130874599/efef1bf435.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000060ae.bin
4978bb8f20da3ed4ca92b3d314b160600c22fabad9bdac193064a48ed4cea8b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60AE 7800 bytes
font_01_sfnt_off00007f08.bin
27a524a27f783356eb02bc5696b06661606a08aa11eb08e473945b57800515f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7F08 2796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.