Malicious PDF — malware analysis report

Static analysis result for SHA-256 31922f3ff2f1f0d4…

MALICIOUS

PDF

40.3 KB Created: 2020-05-14 06:46:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 84c2e6cca792aab205c955d862b7d5c9 SHA-1: a44ada393126f96707a2f131b88c36566110dde8 SHA-256: 31922f3ff2f1f0d42d17484b9f9b5818eba9cda8bb121e3e5497ac2a6b8cfe59
78 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains numerous external links, a common tactic for SEO poisoning and redirecting users to malicious content. The document body, though heavily obfuscated, contains text related to 'accident reports' and includes a prominent URL that appears to be part of a link farm. This suggests the PDF is designed to trick users into clicking links that likely lead to further malicious downloads or phishing pages.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://openformatdjs.net/uploads/1/3/1/4/131406663/131406663.html#jonesboro+ga+police+department+accident+reports
    • http://crosleyhome.com/uploads/1/3/0/4/130483146/0eaefd0726.pdf
    • http://samuelhogan.com/uploads/1/3/0/6/130605019/serukugipi.pdf
    • http://tamarajaros.com/uploads/1/3/0/7/130739930/294b4ad09d8c4d.pdf
    • http://giant-construction.com/uploads/1/3/0/7/130776783/36ac41bb15.pdf
    • http://willdraftsmen.org/uploads/1/3/0/6/130605421/bapunarixiva-xezewekubawe-wexakuza.pdf
    • http://cryptocandy.net/uploads/1/3/0/6/130621677/a4655ab.pdf
    • http://washyourhands.net/uploads/1/3/0/9/130969973/nesuwigede_vowil_mekag.pdf
    • http://qd-hk.net/uploads/1/3/0/6/130639861/2899900.pdf
    • http://tashellemandic.com/uploads/1/3/0/8/130814055/62a367c5.pdf
    • http://osbornecampbellassociates.com/uploads/1/3/1/4/131483029/nazorawesamorijevimu.pdf
    • http://utilitygtr.com/uploads/1/3/0/7/130775918/mokojola.pdf
    • http://fpromotorfran.net/uploads/1/3/0/5/130545884/komabosogovuna.pdf
    • http://free-tanga.com/uploads/1/3/1/0/131069812/02fd8fb5c2.pdf
    • http://doorwayclothing.com/uploads/1/3/0/6/130640209/f67e2f809f.pdf
    • http://miriamemcc.com/uploads/1/3/0/6/130640181/xakimegava_nopedadobek_xitomize_xesidesofoki.pdf
    • http://jessicasparks.com/uploads/1/3/1/1/131163691/notewexuw.pdf
    • http://triquetraphoenix.com/uploads/1/3/0/5/130540097/fofekileriweja-mamepozimivud-pivajimudevufi-nuvuso.pdf
    • http://positionlessbasketballtakes.com/uploads/1/3/1/6/131636879/6580059.pdf
    • http://coacheshvacextraordinair.com/uploads/1/3/0/6/130639535/ae146a.pdf
    • http://rebiofficial.com/uploads/1/3/0/2/130289294/xuxegevorizaranok.pdf
    • http://800crafty.com/uploads/1/3/0/7/130740003/9d3cc1a269d.pdf
    • http://qtum.one/uploads/1/3/1/4/131406434/lutawes-jesitefibasade-wolezo-wufemubobakot.pdf
    • http://ucmgreencampus.com/uploads/1/3/1/4/131437679/5220757.pdf
    • http://aaapowerwashersinc.com/uploads/1/3/1/4/131406115/letaragarivim-xezogebifa-puxenawaxusipux.pdf
    • http://tashellemandic.com/uploads/1/3/0/8/13
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000663f.bin
e2471563708f8728ce2eaf177b5360effcf222f88fef6f1e84702366dd34a49d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x663F 2464 bytes
font_01_sfnt_off00007118.bin
6c1854ab6de267c3f43287ed78e8b9811fc4928e1a44e7b1af864be6b93a8886		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7118 10200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.