Malicious PDF — malware analysis report

Static analysis result for SHA-256 f532ff6f069d3fd5…

MALICIOUS

PDF

45.7 KB Created: 2020-04-24 07:13:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 87da638cc1286ef3effb4dd5fc75a113 SHA-1: 27e51404eee00fefd122992da30c2550a0d2da93 SHA-256: f532ff6f069d3fd57f7435949242121e46d19e52f6ee9e08db26ce68c21ba25a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, a technique often used to create link farms for SEO manipulation or to redirect users to malicious sites. The primary heuristic identified a large collection of external PDF links hosted on various domains, suggesting a coordinated effort to distribute content or lure victims. One of the embedded URLs, http://tidesofchange.info/uploads/1/3/1/8/131871762/131871762.html#the+martyrdom+of+polycarp+pdf, is directly referenced in the document body, indicating a potential primary destination for the redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tidesofchange.info/uploads/1/3/1/8/131871762/131871762.html#the+martyrdom+of+polycarp+pdf
    • http://lisamichener.com/uploads/1/3/1/4/131437523/wovekudakibiro.pdf
    • http://theoregonexpress.com/uploads/1/3/1/6/131606055/4a91f9836fa.pdf
    • http://maesq.com/uploads/1/3/0/5/130551001/27343.pdf
    • http://ctthompsonconsulting.com/uploads/1/3/0/7/130738994/a658c3be1ae3ece.pdf
    • http://lewishubbardgroup.org/uploads/1/3/1/1/131164393/xapidiw-tikeluzap.pdf
    • http://lastingloss.com/uploads/1/3/0/7/130776205/dexovil.pdf
    • http://sharpscience.com/uploads/1/3/0/6/130605516/5080640.pdf
    • http://bulldawgscience.org/uploads/1/3/1/3/131381605/pijusesunovovamoxi.pdf
    • http://myfirex.com/uploads/1/3/1/4/131408252/2346979.pdf
    • http://busenbites.com/uploads/1/3/0/4/130435524/peboluba-gedewewufonok-zofakiruvajakun-podami.pdf
    • http://novi-ia.com/uploads/1/3/0/2/130288321/12c9b45fe.pdf
    • http://vacationrentalinsurance.net/uploads/1/3/1/3/131379776/c29868e6.pdf
    • http://whatsimportantnowinc.com/uploads/1/3/0/5/130588407/4743513.pdf
    • http://higherherbs.com/uploads/1/3/0/6/130604617/gosog.pdf
    • http://translationpen.com/uploads/1/3/0/3/130312961/2870170.pdf
    • http://myfirex.com/uploads/1/3/1
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008825.bin
31608f6924a2e999af556f33a3c1e89082b119bac6fc5ad927a25823f3c5e07b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8825 8580 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.