Malicious PDF — malware analysis report

Static analysis result for SHA-256 fca12f067618a95e…

MALICIOUS

PDF

44.1 KB Created: 2020-05-17 20:47:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 514aa13ebfee20d97ee6799fd0f62e22 SHA-1: f23519095209014c1d32c22df0a06d6e9d09810b SHA-256: fca12f067618a95e2871bdaba0353dc8006408afb4829655d0962ac6db91a07a
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links pointing to various domains, a technique commonly used for SEO poisoning or to distribute further malicious content. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms beyond the linked URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://8128.work/uploads/1/3/0/2/130272481/130272481.html#tulane+university+secondary+school+report
    • http://firstcoastpaintparties.com/uploads/1/3/1/6/131606174/4101597.pdf
    • http://eventstaffboston.com/uploads/1/3/1/0/131070202/2086080.pdf
    • http://iheartschoolcounseling.com/uploads/1/3/0/4/130477882/8799954.pdf
    • http://perfectcentral.net/uploads/1/3/0/6/130620990/fuwinigetonisav.pdf
    • http://financialjusticedelivered.com/uploads/1/3/1/6/131637830/8792661.pdf
    • http://porkpoppinpeople.com/uploads/1/3/0/7/130775759/6548094.pdf
    • http://meadowburials.com/uploads/1/3/1/1/131163615/muxavatarobeked.pdf
    • http://beatzentertainments.com/uploads/1/3/0/5/130588607/3663248.pdf
    • http://shinzuikai.com/uploads/1/3/0/7/130776147/6443480.pdf
    • http://replacerestorerevive.com/uploads/1/3/0/7/130739552/rodikonoweropak-momevi-votazaxoparebop.pdf
    • http://zaideescolourrun.org/uploads/1/3/0/2/130288338/lexugedukumetiwoz.pdf
    • http://prjctfortress.com/uploads/1/3/0/2/130288316/xozevagi.pdf
    • http://hayesmorgan.net/uploads/1/3/0/4/130477074/ebf586e1685.pdf
    • http://danstormheatingandcooling.ca/uploads/1/3/1/4/131482997/7040827.pdf
    • http://amandablau2018.com/uploads/1/3/1/6/131607013/momuj_jevubate_jugas_resaxusoxep.pdf
    • http://terraformprojects.com/uploads/1/3/1/4/131453134/4725143.pdf
    • http://theconductivebody.com/uploads/1/3/1/4/131452826/luvokini-vixisoja.pdf
    • http://lynnettewatson.com/uploads/1/3/0/5/130590219/fowusipimixuwi_zosakozik_dilurajikozudoj.pdf
    • http://centralillinoisaccidentattorney.com/uploads/1/3/1/4/131409090/vegim-joxamazazov-bolivox.pdf
    • http://fournildejean.com/uploads/1/3/1/8/131871977/kipogujoma-deroberesuva.pdf
    • http://westcountryglamping.com/uploads/1/3/0/5/130539021/2173570.pdf
    • http://sarahmo81.com/uploads/1/3/0/5/130551266/5f76c.pdf
    • http://horizonplanhomes.com/uploads/1/3/0/6/130620168/9585067.pdf
    • http://angelawilliamsconsulting.com/uploads/1/3/1/3/131398237/1321064.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000800f.bin
2145c628d29f42d2f7c71777b6e8cd4435e4f03764ed1679743d1b77944c36f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x800F 10500 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.