Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e444bf0f4875a64…

MALICIOUS

PDF

18.8 KB Created: 2020-03-22 04:51:21 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 512849265d7711058dd7c8901a9f80da SHA-1: c2699ddec64c14bf2c364e3532f4e2b145dca670 SHA-256: 1e444bf0f4875a6467df7dcaca6dd6370f4df417f03f8646fddb9fe0c0d5c0b5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links to other PDFs hosted on various domains, suggesting a link farm or redirection mechanism. The document body itself contains a URL that points to a remote HTML file, which likely serves as the next stage of the attack. No scripts were extracted, but the structure and embedded URLs strongly indicate a malicious intent to redirect users to potentially harmful content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://prettyproblems.blog/uploads/1/3/0/8/130874668/130874668.html#que+significa+la+palabra+miradas
    • http://thrivingathletes.com/uploads/1/3/0/6/130604044/lonakaxa.pdf
    • http://collinkliner.com/uploads/1/3/0/8/130813931/guvaxikupoxexukoja.pdf
    • http://mufgmx.com/uploads/1/3/0/6/130604984/tunonelifetujatexe.pdf
    • http://tryshashby-rolls.com/uploads/1/3/0/7/130776006/3127948.pdf
    • http://genckastrati.com/uploads/1/3/0/3/130313087/832ea71.pdf
    • http://mickfarm.com/uploads/1/3/0/6/130640198/xavezadokovusedijo.pdf
    • http://reparaton.net/uploads/1/3/0/3/130313252/d96af9fb47f0db.pdf
    • http://philippinepickleball.shop/uploads/1/3/0/6/130620730/7688579.pdf
    • http://gosiasart.com/uploads/1/3/0/7/130739789/bumadim.pdf
    • http://northwoodhillsgolfclub.net/uploads/1/3/0/8/130813777/pirulazeteta-wokojib-vowekujitov-redixi.pdf
    • http://eastdeanflock.com/uploads/1/3/0/2/130272877/212e2bdf.pdf
    • http://www.iranbureau.com/uploads/1/3/0/2/130270977/6113323.pdf
    • http://cosy-immobilier.com/uploads/1/3/0/7/130776120/xejidiwi_gizerem_boletotikopew_sixedowuwumemog.pdf
    • http://administrator.baileycarpentry.co.uk/uploads/1/3/0/4/130483848/zafax_kegijokis_newarorir.pdf
    • http://prouni2023.com/uploads/1/3/0/2/130272930/3514757.pdf
    • http://autodiscover.corvetteslimited.com/uploads/1/3/0/6/130603696/8883005.pdf
    • http://adsl-208-190-128-212.atcoflex.com/uploads/1/3/0/2/130274370/452744.pdf
    • http://www.mulberrystreetrecords.com/uploads/1/3/0/7/130775364/ruwigepe.pdf
    • http://www.capital-roots.com/uploads/1/3/0/3/130323249/rebogepun.pdf
    • http://beatmytweet.com/uploads/1/3/0/2/130288381/4e6341e.pdf
    • http://thebubblemafia.com/uploads/1/3/0/8/130813539/rujigazaje-vefemokit-webefibipefan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.