Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5dfcc388997df80…

MALICIOUS

PDF

40.4 KB Created: 2020-03-14 13:59:13 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8212abf697f7bc69c0c9c897c12ef563 SHA-1: 860637b162c2534bc97eb7b1195c2fb40ccdf091 SHA-256: f5dfcc388997df805fe39156feec28483a5051dd4060aa05512ea1fdd20426d3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of external links to other PDF documents hosted across various domains. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a deliberate attempt to create a link farm, likely for SEO manipulation or to distribute malicious content. The document body itself is largely unreadable, but the presence of numerous URLs points to a content-distribution or redirection attack. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zhl.brdge.org/uploads/1/3/0/2/130271226/130271226.html#making+comparisons+in+spanish+practice+worksheets
    • http://liftinc.net/uploads/1/3/0/6/130620474/jebagedirene_zobivivebiziki_dubuluxo_manutedep.pdf
    • http://sunshinepics.net/uploads/1/3/0/2/130289669/tosimu.pdf
    • http://lspeg.com/uploads/1/3/0/4/130436389/dululi.pdf
    • http://wellness-restored.com/uploads/1/3/0/6/130640104/873f9299307.pdf
    • http://pristineclean215.com/uploads/1/3/0/9/130969709/kepexumiraditurariti.pdf
    • http://whatthehellokitty.com/uploads/1/3/0/4/130483338/somuwirukusipudoje.pdf
    • http://doodadsandfandangles.com/uploads/1/3/0/7/130739016/de3f23480.pdf
    • http://marketinginalbania.net/uploads/1/3/0/5/130551907/pagib_darinanexifipi_vuvobi_xudupubezubusox.pdf
    • http://twistedmetalbuildz-autosales.com/uploads/1/3/0/7/130738889/ledukazufeli.pdf
    • http://cindysearles.com.cindysearles.com/uploads/1/3/0/9/130969492/417e9ed.pdf
    • http://eflrawfoods.com/uploads/1/3/0/7/130738620/pujorijibutuxodod.pdf
    • http://hollywoodgardens.net/uploads/1/3/0/2/130288416/d99524c.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007356.bin
3ca93756c0fab8d69f57409e70053c9723b21030f28215909cf698c6d50842cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7356 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.