Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4bf9289b9b8d725…

MALICIOUS

PDF

52.7 KB Created: 2020-03-15 11:48:59 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 581312c4c29fed670e70ac08bb23f2d6 SHA-1: 2c29b2b6b6d484f2e0b89b73b29dc7d45192e5b1 SHA-256: f4bf9289b9b8d725ff361dc96cc60771d43c77fe1d031805fd987adce1ceb7e2
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links to various domains, indicating a link farm or SEO spam tactic. The primary heuristic identified a mass of external PDF links, suggesting the document's purpose is to redirect users to these other locations. No scripts were extracted, and the document body is heavily obfuscated, making it difficult to determine a more specific intent beyond link distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aqnft.salon225.com/uploads/1/3/0/4/130476207/130476207.html#blue+danube+waltz+guitar+sheet+music
    • http://amyrrisdplace5.com/uploads/1/3/0/5/130589264/guvuf_debesux.pdf
    • http://virginiaschenk.com/uploads/1/3/0/5/130550985/korodafeli-dofenenoti-bofejir.pdf
    • http://cabanasdichato.com/uploads/1/3/0/2/130287242/2137453.pdf
    • http://dixielandv.com/uploads/1/3/0/6/130621701/tuxidudene_digebule_muverigatuvi.pdf
    • http://nomadfoodtruck.com/uploads/1/3/0/5/130588280/161cc5ed0ff.pdf
    • http://postmaster.postmaster.parvathyprem.com/uploads/1/3/0/5/130543156/zofuzelaz_daxirij.pdf
    • http://www.f8thdesigncups.com/uploads/1/3/0/4/130483629/xisalotafaj-mivejak-pepibavax.pdf
    • http://movingforwardtogethertoday.com/uploads/1/3/0/7/130738786/7880ae84.pdf
    • http://lookgreatnakedatanyage.com/uploads/1/3/0/4/130436007/ac916df9e42.pdf
    • http://mx1.getthoughts.com/uploads/1/3/0/6/130639355/guzagi_dovow.pdf
    • http://yulechengwangzhi.f18.ebkf.org/uploads/1/3/0/9/130969628/saxozub.pdf
    • http://www.halongbaytours.vn/uploads/1/3/0/4/130489523/jilimupizumubixizo.pdf
    • http://ssmonogramsonline.com/uploads/1/3/0/5/130590205/xibakanavawawu.pdf
    • http://74-123-75-201.mgwnet.com/uploads/1/3/0/6/130605521/leluwukaf-nerupokevewawow.pdf
    • http://thehammersolutions.net/uploads/1/3/0/5/130539165/137f66.pdf
    • http://realremodeling.biz/uploads/1/3/0/5/130589217/mowamutiduluv_tovonutowo_pinesonexuxix_lolusamotukiman.pdf
    • http://mk3basketballclinics.com/uploads/1/3/0/3/130323822/jimovus.pdf
    • http://www.buttsbrosfarms.com/uploads/1/3/0/5/130550683/6114ad1f.pdf
    • http://cpanel.pianowithmindeek.com/uploads/1/3/0/8/130814200/tomiwexosagumom.pdf
    • http://friendlywizardroofing.com/uploads/1/3/0/8/130813120/119333.pdf
    • http://techniciancorner.com/uploads/1/3/0/4/130435562/4b878b4e8f4f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009f8a.bin
6e778fdf662127f43d54f881c5e26adfd37027dd3eba3bb6f55b517aae1e46dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F8A 10096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.