Malicious PDF — malware analysis report

Static analysis result for SHA-256 27f076f42e9a1fae…

MALICIOUS

PDF

45.0 KB Created: 2020-04-02 21:20:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e2d0b768a1b77712bb8fb2fa6db8ac8a SHA-1: b67d00964bcf96797b557d645c43e6a99279120a SHA-256: 27f076f42e9a1faec0079466185a76187979f80272d2e1e92ae627c7bf981e1e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF document contains a lure related to 'Kindergarten sight words flash cards' but is primarily a link farm, with numerous external PDF links hosted on various domains. This suggests a Search Engine Optimization (SEO) manipulation tactic or a distribution method for further malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, and 'PDF_URI' points to one such link. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://expensivepups.com/uploads/1/3/0/2/130272350/130272350.html#kindergarten+sight+words+flash+cards
    • http://midloturf.org/uploads/1/3/0/8/130874587/3585e79c.pdf
    • http://rayaneid.com/uploads/1/3/0/3/130313241/aea553216.pdf
    • http://phoenixasiaconsultants.com/uploads/1/3/0/6/130621588/dilezuwokowodo.pdf
    • http://tcronline.net/uploads/1/3/0/5/130544635/rebemat_siwanasumug_bipun_fojeruzalita.pdf
    • http://speakta.me/uploads/1/3/0/6/130620202/8590511.pdf
    • http://ryanbokehphotography.com/uploads/1/3/0/7/130775584/2952613.pdf
    • http://aronkodeshesbydesign.com/uploads/1/3/0/6/130604764/9943742.pdf
    • http://driven-promotions.com/uploads/1/3/0/2/130271185/momonigijibes_livitoxutuzo_mopatuputejuxi_vadajapeb.pdf
    • http://sparcinnovations.net/uploads/1/3/0/2/130273803/ditoj_dixejudawenivev.pdf
    • http://gemandiyoga.com/uploads/1/3/1/1/131164127/6d88a947ff.pdf
    • http://mulherinfoundation.org/uploads/1/3/0/8/130874217/jurunubifej-getikari-fepusikixoxot.pdf
    • http://brawlinfo.com/uploads/1/3/0/4/130476974/1982900.pdf
    • http://bluehoneydew.com/uploads/1/3/0/5/130547624/lirej_xugow.pdf
    • http://ardingtonschoolofcrafts.com/uploads/1/3/0/8/130874679/2ff1f.pdf
    • http://goletacoffeeco.com/uploads/1/3/0/2/130273623/gupomigud-zijoxodi.pdf
    • http://lapaperaartigiana.com/uploads/1/3/1/1/131163879/xagareraw.pdf
    • http://derlungenarzt.com/uploads/1/3/0/7/130774999/1875822.pdf
    • http://encouragingpositivecommunication.net/uploads/1/3/0/5/130588159/e96bb0ef0.pdf
    • http://tanmayms.com/uploads/1/3/0/6/130620464/a4422.pdf
    • http://lifewithpaul.com/uploads/1/3/0/2/130287813/1130395.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007d5d.bin
bd9d7efd62a6ff808edafeb62fa112bc6cc960ac60c74346dcef0d9842a1e06f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7D5D 8108 bytes
font_01_sfnt_off00009ca8.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9CA8 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.