Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e59e0d623ede7b7…

MALICIOUS

PDF

24.9 KB Created: 2020-04-08 09:44:58 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7108a7f773e40cf34e59570d13e73e18 SHA-1: 51fbe3e47f32e1ab8b912a5cf5d1cdf67412d5db SHA-256: 1e59e0d623ede7b75e01f27dbdea3883537a52322017c6a3b840c2ada0ce1d1c
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains a single clickable link that directs to a URL, likely intended to host a malicious payload or phishing page. The PDF also contains a mass of external links, suggesting it's part of a link farm designed for SEO manipulation to distribute malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 24 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pelliccisgastro.com/uploads/1/3/0/2/130288364/130288364.html#ejemplos+de+rese%C3%B1as+historicas+de+hoteles
    • http://creacionesinolvidables.com/uploads/1/3/0/3/130313378/zobodimogavetav-bigejodorana.pdf
    • http://overthetopyouthevent.com/uploads/1/3/0/8/130813381/8309405.pdf
    • http://parkingimprovementsltd.com/uploads/1/3/0/5/130589243/37103.pdf
    • http://fvyoungdems.org/uploads/1/3/1/4/131406799/1247949.pdf
    • http://kreativekidsworld.com/uploads/1/3/0/6/130621847/4332353.pdf
    • http://texasdriveinn.com/uploads/1/3/0/7/130739662/df614dffa1a.pdf
    • http://goodywest.com/uploads/1/3/1/0/131070633/6562bef.pdf
    • http://myberrygoodlife.com/uploads/1/3/0/5/130540461/kijexoturekat-fedevevo-wumat.pdf
    • http://handymanarlingtonheights.com/uploads/1/3/1/4/131484268/5617808.pdf
    • http://bodyartrejuvenation.com/uploads/1/3/0/5/130543035/tedeta_basizulox_kevazug_jejodoz.pdf
    • http://hipsters-shop.com/uploads/1/3/0/4/130483953/rujitisofakufibevesa.pdf
    • http://calvarychurchloveland.org/uploads/1/3/1/0/131070888/bolomexumenun.pdf
    • http://springella.com/uploads/1/3/0/6/130639524/ad5b8f3773691.pdf
    • http://pittsburghorganicsrecycling.com/uploads/1/3/0/2/130291373/3669167.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.