Malicious PDF — malware analysis report

Static analysis result for SHA-256 2a808104251e0975…

MALICIOUS

PDF

39.4 KB Created: 2020-04-02 18:03:53 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e52fa83603703de0400ddda34aad37da SHA-1: bd80f294b35d656f1a18dbc899231b08e9f4ddff SHA-256: 2a808104251e097581b6f41f30880bdc335024fbc5d8b50d4b69eb1846f65434
72 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF contains a large number of external links, many of which are hosted on unrelated domains and use numeric slugs, indicating a link farm or SEO abuse tactic. The presence of a 'download button' heuristic further suggests a lure to trick users into clicking these links. No scripts were extracted from this sample, but the structure strongly implies a phishing or malware distribution attempt via these external URLs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aetnaeretro.com/uploads/1/3/1/4/131484328/131484328.html#we+are+legion+we+are+bob+pdf
    • http://nashvilledancecooperative.org/uploads/1/3/0/2/130272851/tokabovopit.pdf
    • http://artienapolitano3.com/uploads/1/3/1/0/131071231/603250270b0895f.pdf
    • http://shippercloud.com/uploads/1/3/1/1/131164270/mebojozifin-tigosedof-vibufol.pdf
    • http://twiceasnicecleaningcincinnati.com/uploads/1/3/0/6/130622110/dujewejijovogirub.pdf
    • http://familyfarmersmarket.net/uploads/1/3/0/6/130639558/8676428.pdf
    • http://147gateway.whd147.org/uploads/1/3/0/8/130873939/notun.pdf
    • http://heilstattenschule.com/uploads/1/3/0/5/130543437/menokawegubige.pdf
    • http://amandalpitts.com/uploads/1/3/0/9/130969607/marewupazigo-dufow-sadedemene.pdf
    • http://godspeedmagazine.com/uploads/1/3/0/7/130740562/2916598.pdf
    • http://kavalashes.com/uploads/1/3/0/8/130874530/nivasolisamogutaxeso.pdf
    • http://ktshowjumping.com/uploads/1/3/0/6/130620524/zuxibujeniwolasa.pdf
    • http://uptownslice.com/uploads/1/3/0/4/130483781/gemirutima-tetijotuvez-godigifof.pdf
    • http://ivyrhodes.com/uploads/1/3/1/3/131381521/7e8a2.pdf
    • http://dmdhomes.net/uploads/1/3/0/4/130489081/1991018.pdf
    • http://scandiblonde.com/uploads/1/3/1/4/131454396/2079904.pdf
    • http://stand2serve.net/uploads/1/3/0/5/130550847/pulitaxawujekas_bifowejakaleva_jefavininowa_tuxamirapu.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000071f0.bin
6748ecbdfebf47f6eabe5c17d963996572350a4e4a7d9dcf6617f53172f4236e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x71F0 7856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.