Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c25761b4ef1b6a3…

MALICIOUS

PDF

38.6 KB Created: 2020-03-20 02:26:32 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 67b2b3bc964b3bd2d63f29b37fb03783 SHA-1: a809d2afb27125551f587b15c5dcfae2d43620bf SHA-256: 1c25761b4ef1b6a30614039f9ae4e06bc649f06a7526c028a9d3e01a11cba0f5
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are hosted on domains that appear to be part of a link farm. The document body, though partially corrupted, contains text related to an 'Epson perfection v550 photo color scanner driver', suggesting a lure to download potentially malicious software. The presence of numerous, similarly structured URLs indicates a coordinated effort to distribute content, likely malicious, across various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theclassyandjazzyboutique.com/uploads/1/3/0/6/130621164/130621164.html#epson+perfection+v550+photo+color+scanner+driver
    • http://thehouseofpsych.net/uploads/1/3/0/7/130740072/pedemet_lunenawodawaf_nerutami_bomirid.pdf
    • http://myfavoriteplacesrdev250.com/uploads/1/3/0/6/130621160/c81ebeb.pdf
    • http://meritcardmoapp.com/uploads/1/3/0/7/130775513/tomesed.pdf
    • http://benjamintkach.com/uploads/1/3/0/6/130640239/5325970.pdf
    • http://playactionllc.com/uploads/1/3/0/2/130272481/0f2bdcc693.pdf
    • http://mail.rachelewatts.com/uploads/1/3/0/9/130968931/javeb-busogijevirulu-keramirojoku.pdf
    • http://jonijohnston.com/uploads/1/3/0/2/130270941/3352945.pdf
    • http://ryanmatthewmiller.com/uploads/1/3/0/8/130874066/30b3833.pdf
    • http://roxandsol.com/uploads/1/3/0/6/130621025/43d49321.pdf
    • http://jeffreyweissmandds.com/uploads/1/3/0/5/130550967/bafokirenetofes.pdf
    • http://castillos.co/uploads/1/3/0/5/130588492/6c8f2a5b1498cd.pdf
    • http://harvestingsoulsgospeltrio.com/uploads/1/3/0/5/130546391/ralokupisi.pdf
    • http://mail.doodlesoup.ca/uploads/1/3/0/7/130775299/8404587.pdf
    • http://blvd420.com/uploads/1/3/0/6/130639026/7177308.pdf
    • http://youandyournewborn.com/uploads/1/3/0/6/130620512/1fbd7dd14e25a7.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d65.bin
b9d579f52da4082f4994d833387222ce1fc4cbb65781af412d9ba560bf4ede20		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D65 8128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.