Malicious PDF — malware analysis report

Static analysis result for SHA-256 fb81b8e322705956…

MALICIOUS

PDF

47.9 KB Created: 2020-03-13 06:14:38 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 59ed771054d799650e7fa36f47d60395 SHA-1: 0733a5b7dd0302d706e242002a50be1e56294475 SHA-256: fb81b8e3227059565829436fb46ac343a46ee6e216c55bd17555b53c15f884cc
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to host malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically indicates this behavior, with numerous links pointing to domains like whatscript.com and others. The document body contains a seemingly random string that includes one of the URLs, suggesting a potential lure or obfuscation tactic.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://3dklx.bpmtc.com/uploads/1/3/0/6/130621337/130621337.html#hallelujah+shrek+leonard+cohen+mp3
    • http://whatscript.com/uploads/1/3/0/6/130621826/9848015.pdf
    • http://mitchellgribbroek.com/uploads/1/3/0/8/130813732/6ae046c5d72e0.pdf
    • http://paradiseuganda.net/uploads/1/3/0/7/130775796/vuzujogaluvekob.pdf
    • http://keybiscaynetennislessons.com/uploads/1/3/0/6/130622101/nedebor_fukodadadupuk_juketatikig.pdf
    • http://morgan.team/uploads/1/3/0/5/130589339/9876580c19.pdf
    • http://dekrachtvanverbeelding.nl/uploads/1/3/0/8/130814479/satudapozeruju-mojodulano-lubukipidesu-wofufiw.pdf
    • http://traditionalspirit.com/uploads/1/3/0/5/130590770/neposijetasif.pdf
    • http://www.jeffevanstodd.com/uploads/1/3/0/3/130312913/narerijusowegidixamo.pdf
    • http://barbertontreeservice.com/uploads/1/3/0/5/130588509/tenipisit.pdf
    • http://theschizo.net/uploads/1/3/0/4/130476270/eed4b36.pdf
    • http://webazoo.com/uploads/1/3/0/9/130969150/nufepopumi.pdf
    • http://tigernitemail.com/uploads/1/3/0/7/130739780/e8747133c.pdf
    • http://www.lowcountrycommunityservices.com/uploads/1/3/0/9/130968960/8835091.pdf
    • http://nekimastrategy.net/uploads/1/3/0/7/130739945/bekupugene.pdf
    • http://mx.foodcartfranchisingphilippines.com/uploads/1/3/0/3/130323894/7596707.pdf
    • http://wakeforestfarmersmarket.com/uploads/1/3/0/5/130545932/4627171.pdf
    • http://cardigancommuter.com/uploads/1/3/0/3/130379226/jupuxorolu_jixakawemoseje_lujopanegam.pdf
    • http://mail.phimi.pt/uploads/1/3/0/6/130639489/4925071.pdf
    • http://tkobg.com/uploads/1/3/0/5/130539090/lizikela_timon.pdf
    • http://showupshutupandwrite.com/uploads/1/3/0/4/130436139/5b6d6744.pdf
    • http://mx.renderdesigns.com/uploads/1/3/0/5/130538986/mibawozume.pdf
    • http://kilkennyirishdance.com/uploads/1/3/0/4/130479123/cfd2fe67d8.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000898b.bin
2988df39c5f6b20619333442de33f9af4f655d01f24d8a2f5217c1c6c71476bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x898B 11064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.