Malicious PDF — malware analysis report

Static analysis result for SHA-256 fce27f612ad282b7…

MALICIOUS

PDF

36.4 KB Created: 2020-04-23 03:28:19 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 95616a55674289d9f0713e3c32eff892 SHA-1: 865e68375e48d535712e0dccbe56d0d61b8e11d0 SHA-256: fce27f612ad282b72a9ba715724cef1528061d6b66d7cffa0138eba35b73c285
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, a common technique for SEO spam or directing users to malicious sites. The document body, though heavily obfuscated, contains a URL that appears to be part of this link farm. The primary intent seems to be to drive traffic to these external resources, potentially for phishing or malware distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rhiannongower.com/uploads/1/3/1/6/131606016/131606016.html#asus+transformer+tablet+boot+from+usb
    • http://i-provence.com/uploads/1/3/1/3/131398359/weluza.pdf
    • http://givemecoco.com/uploads/1/3/1/4/131453454/b08c81df81.pdf
    • http://thegardinerscottage.com/uploads/1/3/0/7/130739754/2477804.pdf
    • http://educationforprosperity.org/uploads/1/3/0/2/130273913/gixojemejetodagakub.pdf
    • http://at-the-mall.com/uploads/1/3/0/4/130435803/3151914.pdf
    • http://gayaenterpriz.com/uploads/1/3/0/2/130273907/gajetibot.pdf
    • http://benibiz.com/uploads/1/3/0/3/130379651/6935570.pdf
    • http://mycarecounseling.org/uploads/1/3/0/6/130640133/2106181.pdf
    • http://wildywell.com/uploads/1/3/0/3/130323632/4a22cbbb7739a3.pdf
    • http://complianceassurance.org/uploads/1/3/1/4/131438517/dowapomituduzad.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006414.bin
ad7e4c9803a276834ab65febee356568533695eee1e3726cc45cfb85a7cae100		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6414 8784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.