Malicious PDF — malware analysis report

Static analysis result for SHA-256 fd98648623d56975…

MALICIOUS

PDF

39.6 KB Created: 2020-04-10 00:24:54 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 608a56c3a354312bd9b40b0ce7cd332b SHA-1: dcc0109eb7d5155d84ca130b5586b2611238aa6d SHA-256: fd98648623d56975d8f9a5ae33ddf5796fe223dc9cea71b1f91f164c174a97a3
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which are numerically or generically named, suggesting a link farm or SEO abuse tactic. The document body, though partially corrupted, contains a reference to a 'Nissan dayz user manual' and a URL that aligns with this theme, indicating a lure to trick users into clicking on potentially malicious links. The heuristic 'PDF_SEO_LINK_FARM' strongly indicates this malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://agpmav.com/uploads/1/3/0/6/130639863/130639863.html#nissan+dayz+user+manual+in+english
    • http://drmelindamorros.com/uploads/1/3/0/8/130874472/4f497fc331c0e7.pdf
    • http://youarenotaloneart.com/uploads/1/3/0/6/130639464/powunono.pdf
    • http://salcocleaning.com/uploads/1/3/1/0/131070979/d492c046145e.pdf
    • http://joyfullyfed.org/uploads/1/3/0/5/130543285/dewenopa_gopilegimibodi_mumowisagoweboz_zolumamagula.pdf
    • http://adventuredanang.com/uploads/1/3/1/3/131378837/6431090.pdf
    • http://rlfanrewards.com/uploads/1/3/1/3/131384536/5485632.pdf
    • http://bold-and-italic.com/uploads/1/3/0/2/130287883/516381.pdf
    • http://mvmaxclinicadeginastica.com/uploads/1/3/0/5/130588257/eb679a6c.pdf
    • http://mcmillanvetclinic.net/uploads/1/3/0/8/130874248/tilokexigituwo_xilowujebum_mutekobelediw.pdf
    • http://spicyandsaucyblog.com/uploads/1/3/1/3/131381904/lalogojupamutezezatu.pdf
    • http://stingleyfamilyhomes.com/uploads/1/3/0/5/130539714/5780212.pdf
    • http://precedogroup.com/uploads/1/3/0/5/130541443/5282162.pdf
    • http://fiditalkiesllc.com/uploads/1/3/0/7/130740480/d38c1c2b8105.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007037.bin
2d75b2c77d2cb5c3ecf96c8bf5a86d687a18f9970c73da375b08db0a931d8c18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7037 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.