Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc44fe082cefbfba…

MALICIOUS

PDF

43.0 KB Created: 2020-03-29 07:01:06 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 4a07c0e754d63a434b8d105b9208d58b SHA-1: d5c0e74298f32b01116387195a553afdacb0b813 SHA-256: fc44fe082cefbfbaaf2b39523915c4150e826488941ef75b2e6cd5e95bda4e4e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, many of which follow a pattern indicative of a link farm or SEO manipulation. The document body text, though partially corrupted, mentions 'Talento humano en ingles traductor' and includes the wkhtmltopdf generator, suggesting a lure to external content. No scripts were extracted, limiting the analysis of direct malicious actions beyond redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-72-211.mgwnet.com/uploads/1/3/0/5/130539225/130539225.html#talento+humano+en+ingles+traductor
    • http://treeservicechulavista.com/uploads/1/3/0/2/130287239/zerodajita-wotokin-veluberubud-tapuli.pdf
    • http://globalclimatechange.info/uploads/1/3/0/2/130292089/kiwavefufu-vasaluvitob-gefejuzuwoj.pdf
    • http://whenwebandtogether.org/uploads/1/3/0/5/130588467/2156127.pdf
    • http://tt19server.com/uploads/1/3/0/6/130621749/ed44fcb11e05cd2.pdf
    • http://uphillswim.com/uploads/1/3/0/7/130738740/ffeec8.pdf
    • http://bastokportables.com/uploads/1/3/0/2/130272364/e7614270567998.pdf
    • http://fairwayservicesinc.com/uploads/1/3/0/6/130604424/2ffcf0.pdf
    • http://swiftascentmarketing.com/uploads/1/3/0/6/130620341/dcdad5.pdf
    • http://ag-one.com/uploads/1/3/0/2/130287266/a8c14b8a0e0458.pdf
    • http://www.preservelegalsolutions.com/uploads/1/3/0/6/130620551/wowataxivemo-kituwinivivaben-meleforo.pdf
    • http://albertatreatingchemicals.ca/uploads/1/3/0/4/130488832/puzuzujazerupuzuraz.pdf
    • http://www.allergyeasykitchen.com/uploads/1/3/0/4/130477310/5024b5.pdf
    • http://psychedaboutschool.com/uploads/1/3/0/2/130272606/fomaradatolabojapune.pdf
    • http://mta-sts.mail.headphonerepairhouse.com/uploads/1/3/0/8/130814858/nexexunag_losokigadaroso_dakudekisu.pdf
    • http://dazzlingbomshellspaparazzijewelrybykira.net/uploads/1/3/0/6/130604523/kogurogoneda.pdf
    • http://tonypalladino.com/uploads/1/3/0/2/130291040/rebijijabutivadafu.pdf
    • http://ruume.com/uploads/1/3/0/8/130874683/luvapozonanepil.pdf
    • http://wpoids.com/uploads/1/3/0/5/130544703/garoxiguvuxa.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007eb2.bin
a32aee1394b9aceb11fef9d5a6bd879c2fbaa05987c39bb769c47e578638c1f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7EB2 8236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.