Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb0f11162c851e4b…

MALICIOUS

PDF

59.2 KB Created: 2020-04-04 10:25:58 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4c22d59fe18c4504742dc8de4acb116c SHA-1: 3cb9c791d8505241be54261e94fae78c89abebc6 SHA-256: fb0f11162c851e4b23920825da0f703a053a8ac1bf0b3571695206e6711b2b16
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to other PDF files hosted on similar domains. The document body text, though partially corrupted, suggests a lure related to a child and adolescent depression questionnaire. This indicates a likely phishing or malware distribution campaign, where users are directed to a link farm designed to obscure the true malicious intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pettagsbymimi.com/uploads/1/3/1/0/131069904/131069904.html#cuestionario+de+depresi%C3%B3n+infantil+y+adolescente+%E2%80%93+cdi+pdf
    • http://visitwhc.com/uploads/1/3/0/5/130588905/galenalil.pdf
    • http://lighthousehrsolutionsllc.com/uploads/1/3/0/5/130590191/sapawejibid-benebito.pdf
    • http://cagjet.com/uploads/1/3/0/9/130969433/cc0ed0d.pdf
    • http://prayinguponastar.com/uploads/1/3/0/6/130639661/woduninik-sibejuruxexos.pdf
    • http://sleek360cary.com/uploads/1/3/0/2/130289310/motunuvetewut.pdf
    • http://kbtinting.com/uploads/1/3/0/6/130620927/senupelaxuliwez_rusaxekexa.pdf
    • http://chattanoogasoundmachine.com/uploads/1/3/0/7/130739072/lasipebe-waxore-ruxijexifudaga.pdf
    • http://100places-locations.com/uploads/1/3/1/3/131398067/vimizoz.pdf
    • http://fenkirk.com/uploads/1/3/0/7/130739714/76e6351ad0f3a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00009971.bin
bb7c63526ebdc5830dc680a94a1c6d5475fc56138c27f5524d3d21fb8eb12f26		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9971 11048 bytes
font_01_sfnt_off0000c052.bin
9fa4287e4a4dc5cec956aa4afe0ebf1511b6485c40e35ba7d919990d42365b64		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC052 1664 bytes
font_02_sfnt_off0000c908.bin
043f89cdc56a6d687dbde9ca708df5d68a479f0504edd5c2f1c61766139dec50		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC908 10532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.