Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ee20f6d0021ff19…

MALICIOUS

PDF

31.3 KB Created: 2020-06-08 01:29:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 54667f1d9afa210cd64d738ba881a2cc SHA-1: ccde3817e5ffad88706722dfeb80ab0806143c07 SHA-256: 2ee20f6d0021ff19d0ae030487f3a1993a15fb7c2cea52fe8d40d112ef4ff85b
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, a technique often used to redirect users to malicious websites. The document body, though partially corrupted, suggests a lure related to a 'DNA and genes virtual lab worksheet answers'. The heuristic 'PDF_SEO_LINK_FARM' indicates a large number of external links, many hosted on domains that appear to be part of a link farm, further supporting the malicious intent. The primary attack pattern involves tricking users into clicking these links, potentially leading to phishing or malware downloads.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-72-143.mgwnet.com/uploads/1/3/0/7/130740586/130740586.html#dna+and+genes+virtual+lab+worksheet+answers
    • http://katiethepianolady.com/uploads/1/3/0/9/130969373/a844ea0e0559.pdf
    • http://mail.netstreamz.com/uploads/1/3/0/6/130604922/dubej.pdf
    • http://cpanel.serendipiteorganiques.com/uploads/1/3/0/2/130288522/sinerimuget.pdf
    • http://ditidata.com/uploads/1/3/1/6/131606331/961d9461bdcc.pdf
    • http://mail.guadalupecafe.com/uploads/1/3/0/4/130488181/7496304.pdf
    • http://perdidomassage.com/uploads/1/3/0/4/130476317/xoneji_leveg_jejajuduxojiba.pdf
    • http://kyletuckermusic.com/uploads/1/3/0/7/130739445/6172148.pdf
    • https://pezotagufunu.files.wordpress.com/2020/06/wexisebavozosesisowi.pdf
    • https://ladareguk.files.wordpress.com/2020/06/lanenezadaxipifabokeluxo.pdf
    • https://sofifetipi.files.wordpress.com/2020/06/vevupoxajefuwoteware.pdf
    • https://minuboge.files.wordpress.com/2020/06/60275076827.pdf
    • https://pelidabavigi.files.wordpress.com/2020/06/76907901201.pdf
    • https://zasajeloso685135112.files.wordpress.com/2020/06/wevubex.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000518d.bin
fa08c686b00c6efe09e1da3972b2b4aed44488650472188981875c99caeb6f5c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x518D 9352 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.