Malicious PDF — malware analysis report

Static analysis result for SHA-256 420d7fc84663eb39…

MALICIOUS

PDF

197.7 KB Created: 2020-04-05 04:58:07 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 589a1f79b7c25866a9e4e7bdbd022008 SHA-1: 268759a23af4e989e5c9aa566f3e19fb677db0fc SHA-256: 420d7fc84663eb391037a6ba0e216a9999023902f979355e2168e08d1edaeffd
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The file is identified as a malicious PDF by ClamAV. It contains an embedded URI pointing to 'http://drifadesign.com/uploads/1/3/0/6/130620756/130620756.html#trane+furnace+code+2'. The document body, though heavily obfuscated, contains references to this URL, suggesting it's the primary lure. The PDF likely serves as a delivery mechanism for further malicious activity hosted at the linked URL.

Heuristics 3

  • ClamAV: Pdf.Dropper.Agent-9342142-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-9342142-0
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://drifadesign.com/uploads/1/3/0/6/130620756/130620756.html#trane+furnace+code+2
    • http://neighborhoodhodgepodge.com/uploads/1/3/0/3/130313400/disumazunemutolusuna.pdf
    • http://wojtasekrealty.com/uploads/1/3/0/4/130488750/fivufibamujanepafa.pdf
    • http://helenfeild.com/uploads/1/3/0/8/130813762/sudejumizud.pdf
    • http://generationhit974.com/uploads/1/3/0/3/130379058/4eae9cc4f.pdf
    • http://chillmedianorth.com/uploads/1/3/0/8/130874086/variwetu.pdf
    • http://rorosglassartandcrystalskulls.com/uploads/1/3/1/4/131453260/feaef2a59.pdf
    • http://fusionfitretreats.com/uploads/1/3/0/6/130605280/892a4c3311bc6.pdf
    • http://vitiligans.org/uploads/1/3/0/6/130603852/308072.pdf
    • http://blakemanexteriors.com/uploads/1/3/0/9/130969707/302406.pdf
    • http://mellmadedesign.com/uploads/1/3/0/2/130291635/e964cc1.pdf
    • http://sakhalinnaturetours.com/uploads/1/3/0/6/130621684/1838302.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0002e447.bin
bfb976bd8ff56c9da34be25b9270a35128595b75cc23e2563e4b4870d4546dc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E447 9740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.