Malicious PDF — malware analysis report

Static analysis result for SHA-256 28b13446dc9ec493…

MALICIOUS

PDF

39.2 KB Created: 2020-05-17 23:26:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: cfb521bbe6ea8459d1616a0619f4e10f SHA-1: ce0071bbb296557ee48cc1fe3a4b1d85b748f0b8 SHA-256: 28b13446dc9ec493b07aece45bf49b6525870a78101c86f685e8db1ee6eacbce
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document presents itself as sheet music but contains a large number of external links, indicating a link farm designed to redirect users to malicious content. The heuristic PDF_SEO_LINK_FARM firing confirms this behavior, suggesting the document's primary purpose is to host and distribute links to potentially harmful files. The presence of a download button lure further supports the malicious intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://block1949-asu.com/uploads/1/3/1/4/131438234/131438234.html#famous+piano+solos+sheet+music
    • http://liesbussreklam.se/uploads/1/3/0/5/130588695/2780069.pdf
    • http://humanbiomed.com/uploads/1/3/0/5/130589222/zutigu-pevawogujilo-wizinozowowune.pdf
    • http://daltongeorgeauto.com/uploads/1/3/0/5/130550824/0ee9f4b6fc7e.pdf
    • http://r-ewolucje.com/uploads/1/3/0/6/130605504/zinopubopavepe-mozigafexufogus-temef-notap.pdf
    • http://electriciensdpinc.com/uploads/1/3/0/8/130874612/0b8908c641.pdf
    • http://butterlovesbakingco.net/uploads/1/3/1/6/131637484/natagetabera.pdf
    • http://portfolio-mariafumagallli.com/uploads/1/3/1/3/131379946/samomegitejiz_teminoladada_rakiwosug.pdf
    • http://jcjconsultinginc.com/uploads/1/3/1/4/131406934/6171012.pdf
    • http://discriminalnation.org/uploads/1/3/0/6/130640092/6154352.pdf
    • http://raykakobiella.com/uploads/1/3/0/7/130775342/bixirivitaje.pdf
    • http://cateringedm.ca/uploads/1/3/0/2/130272853/92b153196.pdf
    • http://tobedriven.com/uploads/1/3/0/6/130621620/zifedalagixamo.pdf
    • http://opportunitypalestine.us/uploads/1/3/0/9/130969774/logokusunadutepi.pdf
    • http://healyourself-healyourworld.com/uploads/1/3/0/3/130313345/8ad565b293d13c1.pdf
    • http://giraffeseniors.com/uploads/1/3/0/8/130814063/pateriwibiwar_juvuvux_sediw_sugag.pdf
    • http://pluckingbeautiful.com/uploads/1/3/0/3/130313343/21b6371639f4.pdf
    • http://wrapacrossamerica.com/uploads/1/3/0/7/130776526/6968745.pdf
    • http://theleggingdiva.com/uploads/1/3/1/3/131383207/posutonalefisukur.pdf
    • http://sebastianiveswetherbee.com/uploads/1/3/0/3/130379347/ee28b5ee10.pdf
    • http://river-artisans-cooperative.com/uploads/1/3/0/7/130775358/6323637.pdf
    • http://magesterconsultantservices.com/uploads/1/3/0/5/130589331/1fb545818f9776.pdf
    • http://curryhut.net/uploads/1/3/0/5/130550827/4228659.pdf
    • http://thezinniahouse.com/uploads/1/3/0/9/130968949/zetezo.pdf
    • http://nickolausdlachman.com/uploads/1/3/0/3/130323145/2874924.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c5b.bin
5a4a2f356a4d041aa329df5359684e426e4c3d6c4ac5be36045545b3d6bb52ed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C5B 4576 bytes
font_01_sfnt_off00006c41.bin
e5816623359586dc39e5e77a47965c3d6ba81b5995b623fdc7f86aea43190895		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6C41 10600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.