Malicious PDF — malware analysis report

Static analysis result for SHA-256 f938f7799eec2d02…

MALICIOUS

PDF

39.9 KB Created: 2020-03-24 04:07:11 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5f6b307755377fce127f93cba57b930f SHA-1: a723ebf9519ddc91bed205ef8081126fe2dc15da SHA-256: f938f7799eec2d020ca0311d68b9187856cacce80f9f0b3a1ffed6df4e05161d
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body text is minimal and appears to be metadata. The primary function seems to be directing users to a vast array of unrelated websites, likely for SEO spam or to host further malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hypnose-kinderwunsch.com/uploads/1/3/0/5/130551132/130551132.html#fase1+planificaci%C3%B3n.+objetivos-metas.+m%C3%B3dulo+23+semana+1
    • http://redlinepizza.com/uploads/1/3/0/4/130483795/tilosesopik-mijetaso-manavikewole.pdf
    • http://www.baseballadvprep.com/uploads/1/3/0/6/130639124/ec82e359bbbdb7a.pdf
    • http://align432yoga.com/uploads/1/3/0/7/130738885/8617917.pdf
    • http://hostmaster.hetstenenhoofd.nl/uploads/1/3/0/3/130379634/zokub-wilumexolagiju-narurag.pdf
    • http://mybeautifulonabudget.com/uploads/1/3/0/6/130620576/dobofu_tiviterimilizi_zumapu_ruvobus.pdf
    • http://stealyourtaste.catering/uploads/1/3/0/8/130813991/2777787.pdf
    • http://schunkewitzmedicalser.org/uploads/1/3/1/1/131164294/f3ca7554.pdf
    • http://lecitroninspire.com/uploads/1/3/0/7/130776434/dunurewozenuvubesuba.pdf
    • http://tm2l4.bpmtc.com/uploads/1/3/0/5/130588640/fajuzapukojeduru.pdf
    • http://okanaganplasticsurgeons.com/uploads/1/3/0/4/130435876/tijimubetuzejorisoj.pdf
    • http://manilavegans.org/uploads/1/3/0/2/130288924/ziroratorutajed_jerul_bakirijezupub.pdf
    • http://orendagametables.com/uploads/1/3/0/4/130479312/kuxenixip.pdf
    • http://wholehealthdiscoverycenter.org/uploads/1/3/0/7/130740164/28c38.pdf
    • http://smilecntr.com/uploads/1/3/0/3/130313113/6693474.pdf
    • http://mail.janiktremblayhomeopathy.com/uploads/1/3/0/5/130543038/bumuzi.pdf
    • http://mx.cincytshirt.com/uploads/1/3/0/8/130874046/zuxofedibigi.pdf
    • http://scrummages.com/uploads/1/3/0/6/130620796/bd7cb088.pdf
    • http://forestcitycool.com/uploads/1/3/0/6/130621934/welexopa-lonefokuvupuwo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006fc0.bin
94679a8c6b17f237393c2cf1b03007682cf20d61ed2fb13af279c536f486b33c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6FC0 8684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.