Malicious PDF — malware analysis report

Static analysis result for SHA-256 19dc5944e9e4f9a7…

MALICIOUS

PDF

35.4 KB Created: 2020-05-15 05:46:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 5204878599f4cee66eb3c75daf4eb977 SHA-1: fe365982ac2e861d1cb4f6f3911c55ac3bd08dfa SHA-256: 19dc5944e9e4f9a7562562562d9fcd3151b105b6b9d8388bf65943b7413530a7
78 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which appear to be part of a link farm designed for SEO manipulation. The presence of a 'download button' lure and urgency language suggests a social engineering attempt to trick the user into clicking these links. The primary goal appears to be directing users to potentially malicious websites or initiating unwanted downloads.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://michaelwellsart.com/uploads/1/3/0/5/130589070/130589070.html#archbishop+blanch+sixth+form+options
    • http://storiesthatpersuade.com/uploads/1/3/0/5/130542770/watumexaxulukoz.pdf
    • http://koahspeargun.com/uploads/1/3/0/5/130550813/9641380.pdf
    • http://geekchiccreations.ca/uploads/1/3/1/4/131453045/rozivatap_seset_nozuzuwizowa_dobelewuse.pdf
    • http://look-a-livetaxidermy707.com/uploads/1/3/1/4/131438541/c4220f2d0d56e5b.pdf
    • http://bowlingac.com/uploads/1/3/0/2/130289496/zupusa.pdf
    • http://arcboycomputers.com/uploads/1/3/1/6/131606727/5311442.pdf
    • http://infinitydatasol.com/uploads/1/3/1/4/131438086/luzika.pdf
    • http://columbusoptical.biz/uploads/1/3/0/6/130621601/witiv.pdf
    • http://redhooks.com/uploads/1/3/1/0/131070115/sazukugiwe_tewapa_fizumosinoxogu.pdf
    • http://wikinstedia.com/uploads/1/3/0/2/130288533/5138449.pdf
    • http://tiedtogether2019.com/uploads/1/3/1/4/131454207/7464124.pdf
    • http://apvdpt.org/uploads/1/3/1/6/131606149/gogolowobutige.pdf
    • http://bedminsterexcavation.com/uploads/1/3/0/4/130489800/zojadodisi_gugetigar_zidumitu.pdf
    • http://paxark.com/uploads/1/3/1/8/131856456/6682655.pdf
    • http://vayodesign.com/uploads/1/3/0/2/130271184/5353723.pdf
    • http://quiltingbom.com/uploads/1/3/0/4/130488631/93692c.pdf
    • http://southernbritches.shop/uploads/1/3/1/1/131164556/2322480.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005d0c.bin
42b9dd018c2b53eb9d25df0f00b7697a78ec59dae71c35aa4f7ed71bbe34eaba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5D0C 10796 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.