Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a3cee4f5cc15639…

MALICIOUS

PDF

51.7 KB Created: 2020-03-30 18:39:05 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a158e35fe150b329481b690bda93ed97 SHA-1: 7661380da2b4713881e4637e6a859f95b6d109e4 SHA-256: 1a3cee4f5cc15639d174b2da1de60ed2569f11f4904464da54ea7fb9fed16c58
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, many pointing to other PDFs, suggesting a link farm or SEO poisoning tactic. The document body, though partially corrupted, contains text related to school exams and mentions a password for an archive, indicating a social engineering lure. The presence of numerous unknown-reputation URLs suggests a distribution network for malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://iglootw.com/uploads/1/3/0/3/130323527/130323527.html#examenes+bimestrales+de+quinto+grado+de+primaria+2019
    • http://mountainvilleumc.com/uploads/1/3/1/4/131452886/f04fd5.pdf
    • http://ghostofelysianfilms.com/uploads/1/3/0/4/130483736/eaa75eb53.pdf
    • http://spectrumart.org/uploads/1/3/0/8/130874676/d7abffa.pdf
    • http://amazeincorporated.com/uploads/1/3/0/8/130814728/88ea9e6044c721d.pdf
    • http://tabtransport.com/uploads/1/3/0/8/130814062/votexadagosa.pdf
    • http://loonietooniestore.com/uploads/1/3/0/3/130313356/f309d7c56236ad5.pdf
    • http://heartellectual.com/uploads/1/3/1/1/131164421/xemanad.pdf
    • http://trawlerbait.com/uploads/1/3/0/3/130323703/zofuw.pdf
    • http://elite-skills.com/uploads/1/3/0/9/130969162/gezezitemola-fozepivubu-zevawomederu.pdf
    • http://fandbtrends.com/uploads/1/3/0/6/130639350/e17e6aa688d.pdf
    • http://vizyourbiz.com/uploads/1/3/0/9/130968992/7fa962bdf0.pdf
    • http://dylanfilardo.com/uploads/1/3/0/5/130588357/2928761.pdf
    • http://mail.olvsf.org/uploads/1/3/1/3/131380977/mezipi.pdf
    • http://windhofwrites.com/uploads/1/3/0/6/130621732/koxodijeko_reboruz.pdf
    • http://ferreboeuftherapy.com/uploads/1/3/1/4/131408328/389386.pdf
    • http://richardvirtue.com/uploads/1/3/0/5/130588894/35e8df933d.pdf
    • http://jonajarian.net/uploads/1/3/0/6/130620845/3259320.pdf
    • http://bodhibros.com/uploads/1/3/0/2/130287893/2168511.pdf
    • http://faultclothing.com/uploads/1/3/0/9/130968988/lulekir.pdf
    • http://azextremefit.com/uploads/1/3/0/5/130539265/lobir.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000091b5.bin
66f0aad271cfdae52ca1302e01cc2c29ee9ca8c8a65d868c19a3476b3d300aea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91B5 10136 bytes
font_01_sfnt_off0000b57f.bin
ad6001544931b982f6f7da1832bf13fec8344b0eac1307571a142e09cd2bc38c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB57F 2628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.