Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b117ebcfe3053b2…

MALICIOUS

PDF

38.9 KB Created: 2020-03-22 04:21:55 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 9ce8ab9e72bbf498949da503420d792f SHA-1: 0d505e81d3ee2c3826d1e6e129e82ac426290a99 SHA-256: 4b117ebcfe3053b27e38442f37afb86d4ff535ba571bd9f540825d4f46aaa582
70 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF document contains a heuristic firing for a link farm, indicating it's designed to redirect users to numerous other PDF files hosted on various domains. The presence of a 'download button' lure further supports the social engineering aspect. The document body, though heavily obfuscated, contains URLs that are part of this link farm, suggesting a phishing or redirection attack. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://4angelstshirts.com/uploads/1/3/1/1/131164568/131164568.html#min+max+range+excel+graph
    • http://varietyorchestra.org/uploads/1/3/0/2/130287413/bodidedami_fixakonake_mugomenuzamole_badekivox.pdf
    • http://enderman.org/uploads/1/3/0/3/130379770/7ea980c8b1ac.pdf
    • http://carrotboutbaby.com/uploads/1/3/0/6/130605089/wagivimitivaxobutes.pdf
    • http://angelsopinion.com/uploads/1/3/0/6/130604644/8407440.pdf
    • http://www.jjhomez.com/uploads/1/3/0/6/130621648/suxif.pdf
    • http://horncomb.com/uploads/1/3/0/4/130479008/1623354.pdf
    • http://garlandcrew.com/uploads/1/3/0/5/130551057/5274418.pdf
    • http://www.purposethestore.com/uploads/1/3/0/9/130968911/8908403.pdf
    • http://porqueeseidiotasevetanbienyyono.com/uploads/1/3/0/8/130874134/lamukofew-palix-zogoleruxudirol-nuwezo.pdf
    • http://www.weddingdressesvt.com/uploads/1/3/0/9/130969449/vugot.pdf
    • http://pixiechildcare.org/uploads/1/3/0/2/130273610/tutupolike.pdf
    • http://learnfaces.com/uploads/1/3/0/6/130639396/9a3f7.pdf
    • http://designsbylindley.com/uploads/1/3/1/1/131164199/jurelimi.pdf
    • http://carpetcleancary.com/uploads/1/3/0/4/130483924/siripigetutojo_tufuwutaka.pdf
    • http://ikonicmarketing.net/uploads/1/3/0/8/130814296/nutoguzowuxe.pdf
    • http://stridersrunningblog.com/uploads/1/3/0/2/130273899/4837882.pdf
    • http://delhiescortservice.agency/uploads/1/3/0/6/130604886/timaja-guruxiwafow-vevugumip.pdf
    • http://www.strongtowerfellowship.net/uploads/1/3/0/6/130604148/tezawaliwun.pdf
    • http://www.birdinsights.com/uploads/1/3/0/2/130291536/borozi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d2e.bin
ca3c57a756a773684c41a609b163d9f1145c5079648cca6a6322a7ce2bd7b401		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D2E 8136 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.