Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa180a9be6583141…

MALICIOUS

PDF

41.9 KB Created: 2020-04-08 20:57:38 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4c3cc31fedadc92daace8fbbb0980b08 SHA-1: ea7357dc1f105808cdf1ba6c7914246cf90d1ae6 SHA-256: fa180a9be65831419257e2ae7f77659f21afc9fab8f4c127af2a84a6a40f6895
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a significant number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior. While no scripts were extracted, the sheer volume of links suggests a delivery mechanism for further malicious activity. The document body itself appears to be malformed or truncated, but contains a reference to a calendar template, possibly as a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://caregivercoalitionsd.com/uploads/1/3/0/4/130476830/130476830.html#blank+monthly+calendar+template+pdf+2020
    • http://freerangefouchefamily.com/uploads/1/3/0/5/130550994/68ad930c028b05.pdf
    • http://robertdickstudionyc.com/uploads/1/3/0/5/130590367/sipotel.pdf
    • http://i-edu.tw/uploads/1/3/0/4/130476079/223fbb8f.pdf
    • http://jjblackcarservice.net/uploads/1/3/1/4/131437622/lajukozin.pdf
    • http://principalgneely.com/uploads/1/3/1/3/131383726/95cc4499a42f7e.pdf
    • http://texaslivingsoils.com/uploads/1/3/1/1/131164136/mibow.pdf
    • http://eatwell2bwell.com/uploads/1/3/0/4/130476089/d4fffb206b0.pdf
    • http://gardenofarts.org/uploads/1/3/0/6/130621119/gituposipepajux_budovenalumu.pdf
    • http://mskindustries.com/uploads/1/3/0/5/130590142/depekafa.pdf
    • http://greensheepasia.com/uploads/1/3/0/3/130313415/wamuk.pdf
    • http://winkingunicorn.com/uploads/1/3/0/5/130551319/rokegiweb.pdf
    • http://homesofclass.com/uploads/1/3/0/5/130590622/2444930.pdf
    • http://microfinanceprofessionals.net/uploads/1/3/0/8/130873945/155644.pdf
    • http://arrowsandmoondust.com/uploads/1/3/0/3/130323642/nubetuvat_lopumef.pdf
    • http://raceloveandpolitics.com/uploads/1/3/0/6/130639498/zojuzomolojax.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000066c1.bin
611d3f1d60f57461fb218037446c1ea435e044568bfb01485f4fedfed13380bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x66C1 7816 bytes
font_01_sfnt_off0000852d.bin
2d9a456853fe6c0446581e4563fb8dc4b722e0b2c528c521fed10db478da25d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x852D 16108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.