Malicious PDF — malware analysis report

Static analysis result for SHA-256 411d85d428607958…

MALICIOUS

PDF

74.3 KB Created: 2020-05-22 00:50:36 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 4db15724d24bf74502767f56ae4660f5 SHA-1: 45e24b0e6bc1ba385f8a674fd11b32c4a44b8031 SHA-256: 411d85d428607958ab9080e45abc69884360d41e117c8d3437824395b0627056
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many of which point to PDF files hosted on unrelated domains. The document body displays a "Service control manager error 7000" message, which is likely a lure to encourage users to click on the embedded malicious links. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the exact payload.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blackcardu.stefanaarnio.com/uploads/1/3/0/7/130740082/130740082.html#service+control+manager+error+7000
    • http://rollingoaksmemorialcenter.org/uploads/1/3/1/1/131164112/9022246.pdf
    • http://josephsiinoart.com/uploads/1/3/1/4/131453623/b6e239f34d87.pdf
    • http://suranceamerica.com/uploads/1/3/0/3/130313494/21e18ba1425f.pdf
    • http://242bernie242.com/uploads/1/3/0/4/130491513/7570839.pdf
    • http://patriotwastesolutions.net/uploads/1/3/1/3/131383624/bupomeb.pdf
    • http://josecarlier.com/uploads/1/3/0/5/130539412/2200839.pdf
    • http://scubaphone.org/uploads/1/3/1/4/131409616/1ec7c5.pdf
    • http://creationsbydanilynn.com/uploads/1/3/0/4/130477719/tamitorazizu_kozof_bilagow_nulewiwel.pdf
    • http://nutragredients.com/uploads/1/3/1/6/131637186/8252527.pdf
    • http://assuntagiannico.com/uploads/1/3/1/3/131379546/3763684.pdf
    • http://drbozner.net/uploads/1/3/0/7/130738805/9203797.pdf
    • http://professionaligboladies.org/uploads/1/3/0/9/130969435/50a90999771e2a.pdf
    • http://trccommons.org/uploads/1/3/1/0/131070719/nafoto.pdf
    • http://taylortransit.net/uploads/1/3/0/3/130379824/zalunatenexerepu.pdf
    • http://albatrosdeveloppement.fr/uploads/1/3/1/4/131452929/1833350.pdf
    • http://bigpersonalitieslittleportraits.com/uploads/1/3/1/8/131856809/6d4e7daff.pdf
    • http://ministeriocristianopoderdel.com/uploads/1/3/0/3/130313422/3072200.pdf
    • http://recyclingsolutionsltd.com/uploads/1/3/0/6/130620573/voratizep_vininopitetedi.pdf
    • http://rainbowbost.com/uploads/1/3/0/7/130775841/xodugaf.pdf
    • http://sanah.co/uploads/1/3/0/7/130740419/guxodigomitapixafe.pdf
    • http://ourcommunitymovement.com/uploads/1/3/1/4/131407588/1362912.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f578.bin
afe2bc22e8f419f831d279e4665e89fb09f4aa9271e4a21b07d49a7ba4d23cf3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF578 11792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.