Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecf0650ae2af37f0…

MALICIOUS

PDF

35.1 KB Created: 2020-04-01 16:00:15 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6bdc5536a9ebbdd8ed11b76dde4656de SHA-1: 4fdf1d4e549845af9ea4157470791f14b9bf31e0 SHA-256: ecf0650ae2af37f0672ad2c8d21ce38c9360504647ba8025751873677d66dc0c
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to various PDF files on different domains. This technique is often used for SEO spam or to distribute malware. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 22 external links, suggesting a malicious intent to redirect users to potentially harmful content. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bluelinecigarclub.com/uploads/1/3/0/4/130488694/130488694.html#android+studio+linearlayout+equal+spacing
    • http://thatsummer.org/uploads/1/3/0/5/130590521/gujog.pdf
    • http://meetings.international/uploads/1/3/0/7/130776206/8010950.pdf
    • http://meredithreednyc.com/uploads/1/3/0/5/130589159/jekodunuge.pdf
    • http://st-thomaslutheran.org/uploads/1/3/0/8/130813714/3b92d2afa.pdf
    • http://meshayla.com/uploads/1/3/0/7/130775002/3003195.pdf
    • http://langfordaviation.com/uploads/1/3/0/5/130540186/4684655.pdf
    • http://ben-franklin-quotes.com/uploads/1/3/0/5/130588489/sisitopovol-ronoza-jamaz-mojip.pdf
    • http://gilbertsonexpertwitness.com/uploads/1/3/0/5/130541837/bofijufej_turulodo_vagopos_mulanuwetorozug.pdf
    • http://stompsfootwearandmore.com/uploads/1/3/0/5/130590613/f12845a8.pdf
    • http://chantalhairbraiding.net/uploads/1/3/0/8/130813643/32fd360d1.pdf
    • http://santarosatree.com/uploads/1/3/0/2/130288488/modopokelezon.pdf
    • http://lakecumberlanddiscount.com/uploads/1/3/0/7/130775304/xajuxozuxef.pdf
    • http://deliciosocreperie.com/uploads/1/3/0/6/130604548/lusugof.pdf
    • http://citygatecorp.com/uploads/1/3/0/8/130814100/bifajemix-bofajawonizubog-fixuba-lujetarogizixe.pdf
    • http://jminvestmentplanning.com/uploads/1/3/0/5/130539934/794824ec2663f.pdf
    • http://nolanthomascoffey.com/uploads/1/3/0/8/130873986/kejaruz.pdf
    • http://orionhat.com/uploads/1/3/0/3/130324065/zigoxunin.pdf
    • http://stemresourceshawaii.org/uploads/1/3/0/7/130739483/kumuxifowet-xuxili.pdf
    • http://svcstyle.com/uploads/1/3/0/9/130969548/pademuxekubelex_jojoru_tejelowemuxana.pdf
    • http://jwstern.com/uploads/1/3/0/9/130969681/5495419.pdf
    • http://prekmathematics.org/uploads/1/3/0/8/130874139/6125155.pdf
    • http://rapidroofingandconstructionllc.com/uploads/1/3/1/0/131070918/7f3656.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000620d.bin
15fdf0718c31d92db1011ac03b7e37904bbe15aebd1d4312b81f4a60f5660d6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x620D 7928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.