Malicious PDF — malware analysis report

Static analysis result for SHA-256 edddc50fed365d6a…

MALICIOUS

PDF

51.4 KB Created: 2020-04-03 13:37:55 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 74887dd2427fa961b4a35729bcb0cbdc SHA-1: 6ccb1cd15889f0956620502de707275b12310d39 SHA-256: edddc50fed365d6a3375eef7bb48c139b4b21e56f2974bc8ffaf6142b69513d4
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to similarly structured URLs on different domains. This suggests a link farm or SEO poisoning tactic designed to drive traffic to potentially malicious sites. The document body, though partially corrupted, contains a reference to a product review, likely a lure to encourage users to click the embedded links. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gothrivewithcbd.com/uploads/1/3/0/4/130483739/130483739.html#review+aquasana+whole+house+water+filter
    • http://worksbyfaith.net/uploads/1/3/0/3/130324167/jitovanefup.pdf
    • http://fairybrandmom.com/uploads/1/3/0/7/130775306/8051337.pdf
    • http://useekufindshop.us/uploads/1/3/0/6/130639608/wofipesemadetakalem.pdf
    • http://michaelbicycles.com/uploads/1/3/1/0/131070378/efcba83ffe.pdf
    • http://free-bankruptcy-consult.com/uploads/1/3/0/6/130603931/luliva_zutosud_palanexutawix_tubagib.pdf
    • http://waggawaggaprobus.waggamatters.com/uploads/1/3/0/3/130379423/232b253a2bd0e9c.pdf
    • http://friendsofsmschools.org/uploads/1/3/0/2/130289530/889596304.pdf
    • http://waterworkscaribbean.com/uploads/1/3/0/6/130639848/1699741.pdf
    • http://maxkungli.com/uploads/1/3/1/0/131070842/d8aec3ea.pdf
    • http://guidotrivellini.net/uploads/1/3/0/7/130776616/8541438.pdf
    • http://thepureandnaturalproductcompany.com/uploads/1/3/1/4/131437619/suvodopabagaduf.pdf
    • http://eseagroves.com/uploads/1/3/0/7/130776358/semulara-guzipoku-xagotexozebalu-nitinikenileviw.pdf
    • http://lessons4life101.com/uploads/1/3/0/6/130640181/kodugaji_zakumakir_xulabixonabuti_xiwerewu.pdf
    • http://divinemeditations.org/uploads/1/3/0/6/130620869/3793028.pdf
    • http://arandy.net/uploads/1/3/0/8/130874474/saselosuxofiwege.pdf
    • http://rasterinterrupt.net/uploads/1/3/0/5/130588289/d7dde.pdf
    • http://ganaderiaregenerativacolombia.org/uploads/1/3/0/6/130621890/wenara-mikoduzino-wozegowidajese-xigew.pdf
    • http://mariyamamura.com/uploads/1/3/0/8/130813144/1529387.pdf
    • http://mystudiosonline.com/uploads/1/3/0/7/130740477/add05c50f.pdf
    • http://shibagarden.com/uploads/1/3/0/5/130547038/2784692.pdf
    • http://fymandco.com/uploads/1/3/1/3/131383462/9243219.pdf
    • http://x-factornutrition.com/uploads/1/3/0/6/130639546/nemodoreboj.pdf
    • http://minited.org/uploads/1/3/0/3/130379804/5ec31f106f2786.pdf
    • http://berlinsongfestival.com/uploads/1/3/0/7/130775510/tidofatepibosibu.pdf
    • http://minited.org/uploads/1/3/0/3/130379804/5ec3
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009491.bin
4edc190326032f7ebec442d2984b5bbb75cab7d3bf59eece3928a800463bd416		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9491 8728 bytes
font_01_sfnt_off0000b5db.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB5DB 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.