Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3e332e39c2d854c…

MALICIOUS

PDF

34.3 KB Created: 2020-04-09 03:48:33 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 95fed9f615e10034da774d9e1b85ac98 SHA-1: 339b068f276e3913353f73f676b44b4d0bcf670b SHA-256: f3e332e39c2d854cf3daa7ca4d01103d9dc2f33e48297ab50e20cbf6e9856b74
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. The document body, though heavily obfuscated, contains a URL related to a video game cheat, suggesting a lure to attract users. The heuristic 'PDF_SEO_LINK_FARM' indicates a deliberate attempt to create a link farm, likely for SEO manipulation or to distribute malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://votetcu2905.us/uploads/1/3/0/6/130605358/130605358.html#rare+candy+cheat+in+pokemon+mega+emerald+x+and+y
    • http://megsediting.com/uploads/1/3/1/3/131383889/5836327.pdf
    • http://herbily.net/uploads/1/3/0/4/130435722/donaru-juwexox.pdf
    • http://almostprohockey.ca/uploads/1/3/0/4/130477335/611553.pdf
    • http://globalordinancedept.org/uploads/1/3/1/1/131164569/bazid-betebodukodadar-janebavataperon.pdf
    • http://oman-businesscouncil.com/uploads/1/3/0/8/130814682/rebewasoku_sibilipuvananup_ketamelije_lawaso.pdf
    • http://thatchersdowntown.com/uploads/1/3/0/7/130775164/931ef2.pdf
    • http://salesgrowingpains.com/uploads/1/3/0/2/130270971/kiduv.pdf
    • http://lottlawoffice.com/uploads/1/3/0/8/130814060/5532ce7b44487.pdf
    • http://weceee.com/uploads/1/3/0/2/130289569/4895799.pdf
    • http://raysfinelinens.com/uploads/1/3/0/2/130271121/govuvifa.pdf
    • http://ellelouiseferguson.com/uploads/1/3/0/6/130604653/2601549.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005db3.bin
fa930263d40f3215769c0710b6cb38b11e86ab75bffc90a6d8df87ad0320790a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DB3 7704 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.