Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e189106d9464e08…

MALICIOUS

PDF

46.9 KB Created: 2020-03-07 12:40:42 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 492b3164a5a3259075553150b925d27a SHA-1: 4437f0cd06dd2a3cf424e889e04b6a279155c58f SHA-256: 2e189106d9464e083496bf870e3cf420430227d81d584754a376d97145eaf716
110 Risk Score

Malware Insights

MITRE ATT&CK
T1204.001 Malicious Link T1566.002 Spearphishing Attachment

The PDF document contains a lure related to browser extension installation and fake invoices, aiming to trick the user into downloading further malicious content. It embeds a large number of external links, many pointing to PDF files hosted on various domains, suggesting a link farm or redirection mechanism. The primary attack pattern involves social engineering to prompt the user to click on these links, which likely lead to malware or phishing sites.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wangluoqipaiyouxidaili.br3h.com/uploads/1/3/0/7/130740124/130740124.html#pan+card+change+form+latest
    • http://ryansjewelryshop.com/uploads/1/3/0/4/130477890/126884efc.pdf
    • http://www.ahtiras-africa.com/uploads/1/3/0/6/130621649/615b9278e.pdf
    • http://sunnyvalecoffee.com/uploads/1/3/0/7/130775489/8987078.pdf
    • http://mta-sts.mx.discovermichiana.com/uploads/1/3/0/5/130588415/23271.pdf
    • http://ideasinaday.com/uploads/1/3/0/6/130639790/gakupusidotuxex.pdf
    • http://delighteddaughter.com/uploads/1/3/0/2/130289765/7045898d.pdf
    • http://troyharman.com/uploads/1/3/0/6/130639630/5651fa284e78.pdf
    • http://shuttcv.com/uploads/1/3/0/4/130477048/5823805.pdf
    • http://justafirstdraft.com/uploads/1/3/0/2/130272095/7840170.pdf
    • http://btravels.co.za/uploads/1/3/0/5/130539783/xezonunomi-tubofanurigusez-kasajevupo.pdf
    • http://webdisk.loikitsoil.com/uploads/1/3/1/0/131071167/morokaluwa.pdf
    • http://aurasalontn.com/uploads/1/3/0/3/130379357/dovad.pdf
    • http://lizrudey.com/uploads/1/3/0/8/130814716/8967192.pdf
    • http://germanaudiospecialties.com/uploads/1/3/0/5/130543569/31267025337b462.pdf
    • http://www.roopagangopadhyay.com/uploads/1/3/0/2/130272247/zuxubanavobajajot.pdf
    • http://allabouthomerecording.com/uploads/1/3/0/2/130271154/9500394.pdf
    • http://hostmaster.astuteexercisephysiology.com.au/uploads/1/3/0/7/130739713/videxusivusegof-rovejavovimo-dobuzelavenol-zarozikol.pdf
    • http://e-y-o-6.com/uploads/1/3/0/6/130621457/mepijinefipal.pdf
    • http://emilydowlingfriedman.com/uploads/1/3/0/4/130483207/10207d443.pdf
    • http://www.superbdave7771and1.com/uploads/1/3/0/4/130435941/9e55c6eadf.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008fab.bin
77a2a90644db449a03844b1e9650b8bba3c8a976f29cb50bfecd4d6a6f80af09
pdf-font-stream PDF embedded font (sfnt) at offset 0x8FAB 7828 bytes