Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed2ecd4243f659cb…

MALICIOUS

PDF

27.7 KB Created: 2020-05-31 07:31:59 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 6cb0c116a5a4b90961f999fcedef484c SHA-1: 2d4bb42cfa5621154fbb748ee375a8c685771974 SHA-256: ed2ecd4243f659cb186c0c9b3a92872c985a27192b54acfa0a49a76153274ca4
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of external links, many of which point to other PDF files on various domains. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to malicious content. The ClamAV detection as 'Pdf.Dropper.Agent' further supports a malicious intent, likely involving the delivery of further malware or phishing content through the linked PDFs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-8899868-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-8899868-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adsl-63-204-18-6.benefitplans.org/uploads/1/3/1/4/131454986/131454986.html#brother+mfc-j825dw+service+manual
    • http://ashavida.org/uploads/1/3/1/4/131453028/xesoxarujewofeka.pdf
    • http://laurenskustomcreations.com/uploads/1/3/0/5/130590108/994849f7753ba.pdf
    • http://mta-sts.mx.stonesockfibers.com/uploads/1/3/1/0/131071111/tunokipa.pdf
    • http://squishlv.com/uploads/1/3/0/8/130874113/fcea0.pdf
    • http://ahjessup.com/uploads/1/3/1/1/131163660/1898289.pdf
    • http://dodsonph.com/uploads/1/3/0/7/130739015/423370.pdf
    • http://mta-sts.oldfashionedsoap.com/uploads/1/3/0/6/130620873/gijuno.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045cd.bin
c89bbf3d93a08c3bef0274df1b53a56895bfe1e2af8aef9ac18456fee71f6df3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45CD 9140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.