Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe673397256cf0c4…

MALICIOUS

PDF

50.2 KB Created: 2020-04-08 01:37:38 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3bf50ba149b1202aba54d7688084e197 SHA-1: f7798e5b4b83e4666b3ddb379d9ae49b80d0efb9 SHA-256: fe673397256cf0c490735445282e8832172e4d8fd059e798ba37a3d5b2ad90d5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text that appears to be a lure, and the embedded URLs point to numerous other PDF files. This suggests the primary purpose is to act as a link farm, potentially for SEO manipulation or to distribute further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://onkoyoga.com/uploads/1/3/0/6/130639827/130639827.html#anchoring+script+for+farewell+party+in+school+pdf+in+hindi
    • http://cardioanestjc.com/uploads/1/3/0/8/130814492/7526904.pdf
    • http://ignitepayments-network.com/uploads/1/3/1/1/131164052/lugana.pdf
    • http://thomesbrosequipment.com/uploads/1/3/0/5/130539355/xevorikerutakiz.pdf
    • http://buenodigital.net/uploads/1/3/0/7/130776755/6174471.pdf
    • http://healthspiritfreedom.com/uploads/1/3/0/3/130324044/1d1f672fb70b.pdf
    • http://washandshine.net/uploads/1/3/0/2/130289546/madefufepixemuwef.pdf
    • http://hounddogantiques.com/uploads/1/3/0/2/130270793/zoxebapiviwavux.pdf
    • http://allplating.com/uploads/1/3/1/3/131398139/2835960.pdf
    • http://cindyweaver2017.com/uploads/1/3/0/7/130775965/peropoveso.pdf
    • http://shine2bright.com/uploads/1/3/0/5/130588345/rorufa.pdf
    • http://continuum-portal.com/uploads/1/3/0/2/130289354/nofiparisik_desural.pdf
    • http://queenscyclingclub.org/uploads/1/3/0/5/130540281/zudip.pdf
    • http://estherkamara.com/uploads/1/3/0/5/130545173/b512aef0.pdf
    • http://troyyu.photography/uploads/1/3/0/4/130476703/6479653.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007c34.bin
11b9660be68ce30e97fee672626b8e837814d2b65c0baadc977d701a60f6aac4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7C34 7892 bytes
font_01_sfnt_off00009a99.bin
a006e5373e16d90d792ebf7f64c3adc5fd32e4d49121a5090f7776fa53f7bb20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9A99 11612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.