Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed43701c1f5e8df9…

MALICIOUS

PDF

39.6 KB Created: 2020-03-28 12:41:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 67ea358eda291b538546f5a940800f3b SHA-1: d48a1e160ae3389a79d2e63dfa649a71da08fdf8 SHA-256: ed43701c1f5e8df943eead9d0a9c62c55536301d6565fde51ef72e6060082bc3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a common tactic for SEO spam or phishing. The document body, though heavily obfuscated, contains text related to sorting pivot table labels and mentions the wkhtmltopdf tool, suggesting a lure to external content. The primary heuristic identified a link farm of 21 external PDF links, indicating a malicious intent to drive traffic to potentially harmful sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cityonloc.com/uploads/1/3/0/2/130287547/130287547.html#manually+sort+column+labels+in+pivot+table
    • http://nusgss.org/uploads/1/3/0/6/130605010/3719788.pdf
    • http://mx.accentstudioks.com/uploads/1/3/0/5/130551434/poguvexusal-duraden-lemet.pdf
    • http://siservicesgroup.com/uploads/1/3/0/3/130324289/nupubunonakefomajezu.pdf
    • http://alanjonesart.com/uploads/1/3/0/5/130541465/kikal.pdf
    • http://hostmaster.iyasako.co.uk/uploads/1/3/0/2/130273790/pabol-legokulevopotir.pdf
    • http://svensktspel.se/uploads/1/3/0/5/130546024/nogajo_rojesa_wewogomolonizos_zakorero.pdf
    • http://woolyknot.com/uploads/1/3/0/8/130814118/tezibu-fabizoginew-zotijilu.pdf
    • http://simcoecountygunclub.com/uploads/1/3/0/6/130603982/febekupodezuli.pdf
    • http://host36.carmichaelnl.com/uploads/1/3/0/9/130968931/9274531.pdf
    • http://mta-sts.notchviewpediatrics.com/uploads/1/3/0/6/130620556/teregomop_tamosomad_jabapez_jaxomafi.pdf
    • http://www.stvituscatholicschool.org/uploads/1/3/0/5/130588773/3e5b35c0ac4c766.pdf
    • http://birdsintrees.net/uploads/1/3/0/2/130289387/sowasisovidi.pdf
    • http://drumnbassment.com/uploads/1/3/0/5/130538939/simowazimelosev_safojegoboduji_zabodaminarigak.pdf
    • http://ats.tylersharris.com/uploads/1/3/0/2/130272267/8600133.pdf
    • http://catchingpips.net/uploads/1/3/0/5/130590355/0743c5909fb15d.pdf
    • http://barringtonmasons.com/uploads/1/3/0/4/130436108/fezuwadavoli.pdf
    • http://heavenlycitizenship.com/uploads/1/3/0/8/130874592/a86124bf2d236.pdf
    • http://www.oecmp.com/uploads/1/3/0/6/130604180/kixalode.pdf
    • http://oriolfinancial.com/uploads/1/3/0/3/130313489/1f3855cf.pdf
    • http://nataliemunroe.com/uploads/1/3/0/3/130313561/xafibojonesezet.pdf
    • http://betterbodyfitnessbootcamps.com/uploads/1/3/0/7/130738837/noxalupepexagaxagur.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007133.bin
16f250ff031bb6130d8fc7f26d20bb928d3bd42abd7e5f7631b30ed248dc6ff1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7133 7608 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.