Malicious PDF — malware analysis report

Static analysis result for SHA-256 46d5eba23e968dbe…

MALICIOUS

PDF

38.6 KB Created: 2020-03-12 11:02:43 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 484f695c2f7682b5f0c410fdbfb42576 SHA-1: d75551176d75daea0c4f6f458b3dc58813b9f6a6 SHA-256: 46d5eba23e968dbef3b90225735589098705bccc9a2847538f05ecb16e595f3e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF document contains a mass of external links, many of which point to similarly structured URLs. The document body also contains a specific lure related to 'Airtel dth karnataka mega sd pack' and the 'SE_CALLBACK_LURE' heuristic indicates a callback phishing or tech-support scam pattern. The primary attack pattern involves directing users to external resources, potentially for credential harvesting or to initiate a scam conversation.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://host172.carmichaelnl.com/uploads/1/3/0/2/130288410/130288410.html#airtel+dth+karnataka+mega+sd+pack
    • http://are-you-called-to-preach.com/uploads/1/3/0/3/130323602/7909673.pdf
    • http://www.dunwiley.co.uk/uploads/1/3/0/7/130739463/7633505.pdf
    • http://satellitesessionsmusic.com.au/uploads/1/3/0/3/130379676/375083.pdf
    • http://www.oneroommusic.com/uploads/1/3/0/8/130813786/zavujobam.pdf
    • http://boltclan.org/uploads/1/3/0/8/130814208/380738d.pdf
    • http://thethonyguyfoundation.com/uploads/1/3/0/6/130640175/vipemejopesamokuz.pdf
    • http://etinc-l.com/uploads/1/3/0/5/130590383/rukositowawinu-vutet.pdf
    • http://www.vegrandeur.com/uploads/1/3/0/6/130639326/ba86c36.pdf
    • http://www.lefebvrelighting.com/uploads/1/3/0/7/130776331/buxuwo_kadina_jufovubumigek_mifedejilojerab.pdf
    • http://ohmylox.com/uploads/1/3/0/5/130589056/e4677d8f4bcb5b.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005625.bin
fcd7374875eecfae4da3bac9c79c85ecc730ba10cb65e4ded0e78661d39d74d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5625 8268 bytes
font_01_sfnt_off00007614.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7614 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.