Malicious PDF — malware analysis report

Static analysis result for SHA-256 19e86290f7fe890d…

MALICIOUS

PDF

36.4 KB Created: 2020-06-23 12:51:08 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 51e586c7ce1a86644bab3269d589c507 SHA-1: d7ba82e434ec63c0a31ee37767a27fbf5654b482 SHA-256: 19e86290f7fe890d8fcd40903ccc1b6eaa08485883a931c062113b9b25f5173e
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body also contains embedded URLs, such as http://mercygateministries.org/uploads/1/3/1/3/131383650/131383650.html#study+excel+pdf. This suggests the document's primary purpose is to redirect users to a network of websites, potentially for SEO spam or to host further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mercygateministries.org/uploads/1/3/1/3/131383650/131383650.html#study+excel+pdf
    • http://nilen.org/uploads/1/3/1/6/131606550/futimezawotebav.pdf
    • http://mychickadeesfuntasticnest.com/uploads/1/3/0/5/130590656/voxikexativofo_juwatebevoz_mumevapaxadet_fafikomidulo.pdf
    • http://sweetfernliving.com/uploads/1/3/0/5/130543468/vegiranimemokasimi.pdf
    • http://14.undesirable.us/uploads/1/3/1/6/131606890/d1324c2.pdf
    • http://graceandclass.com/uploads/1/3/1/4/131454420/wiromaboxer_tepap.pdf
    • http://activeboostworks.com/uploads/1/3/0/7/130776737/9977241.pdf
    • http://businessethicspro.com/uploads/1/3/0/6/130621258/5283791.pdf
    • http://74-123-75-90.mgwnet.com/uploads/1/3/1/1/131164273/4093323.pdf
    • http://hostmaster.suepedley.com.au/uploads/1/3/1/3/131398380/8136161.pdf
    • http://rachelcooksketo.com/uploads/1/3/0/6/130639764/d5cd86d2.pdf
    • http://reconmetals.ca/uploads/1/3/1/3/131379946/9756548.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051ba.bin
6f7884e673de57723c7c1ec2ea4ccd9653af4d2d06d345f678a565200b78bc4b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51BA 4556 bytes
font_01_sfnt_off0000615e.bin
2c576331523766f651d00e810a521501d1aab68b61e68de7656bed417b49aa79		 pdf-font-stream PDF embedded font (sfnt) at offset 0x615E 10592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.