Malicious PDF — malware analysis report

Static analysis result for SHA-256 266ee2dd38c40b4a…

MALICIOUS

PDF

56.7 KB Created: 2020-04-10 23:26:23 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a70bf68479f958ba5d3104bd91471d01 SHA-1: 0f798754cc2fafd9637acce984d8109562c8a037 SHA-256: 266ee2dd38c40b4aa124701b5bc27c5f4c8513cb819a18f169aba47be6a2ba8c
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, with multiple links pointing to suspicious domains. One of these links, http://fomtasnj.info/uploads/1/3/0/4/130490719/53886c6.pdf, is highlighted by a critical heuristic. The document body also contains urgency language, suggesting a phishing or social engineering attempt to trick the user into clicking the malicious link.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://afaparents.org/uploads/1/3/0/7/130776220/130776220.html#mr+smith+goes+to+washington+viewing
    • http://fomtasnj.info/uploads/1/3/0/4/130490719/53886c6.pdf
    • http://boldmissybrewery.com/uploads/1/3/0/2/130287428/zamojakepomobo.pdf
    • http://shalominc.net/uploads/1/3/1/3/131378796/nibap.pdf
    • http://hoftenlaere.net/uploads/1/3/0/6/130603783/fojurabegavusa_bodiwef.pdf
    • http://victoriacommercialproperties.com/uploads/1/3/1/3/131384544/666aa4.pdf
    • http://recallcathy.com/uploads/1/3/1/3/131398401/guvunuvogepen-dejenopokatus-foweba.pdf
    • http://shakagoodfoodculture.com/uploads/1/3/0/3/130379770/9280109a6a5be4.pdf
    • http://hippiedaisy.com/uploads/1/3/0/4/130475909/muriteviwe-nexopawi-lisopof-soxosajegifume.pdf
    • http://hoftenlaere.net/uploads/1/
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b582.bin
66e962d9b98cebb094e4338ae613d8936d26268b3e7c58889c1c0f631e960745		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB582 8716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.