Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c25bda035cf412d…

MALICIOUS

PDF

70.3 KB Created: 2020-03-30 14:25:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 63fdb12cf4ef739b5f730ae87986cfba SHA-1: e63c7eebe5503d39aa083290b205dac864d7656c SHA-256: 4c25bda035cf412dfdd9c10dedb5eed228ca9479af85b428a595794a4abd1e91
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to similarly structured URLs on different domains. This pattern is indicative of a link farm used to artificially inflate search engine rankings or to distribute malicious content. The embedded URL 'http://multistreams.com/uploads/1/3/0/7/130776605/130776605.html#msp430+microcontroller+programming+tutorial' suggests a lure related to programming tutorials, which is a common tactic for phishing or malware delivery.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://multistreams.com/uploads/1/3/0/7/130776605/130776605.html#msp430+microcontroller+programming+tutorial
    • http://pastorgenevieve.com/uploads/1/3/0/6/130604213/9981479.pdf
    • http://randylaubphoto.com/uploads/1/3/0/8/130874264/ee4cb2eac8a5.pdf
    • http://youniquebyvalery.com/uploads/1/3/0/3/130313228/varifegomufofi.pdf
    • http://global-quests.com/uploads/1/3/0/6/130639746/xokavumusebisutonud.pdf
    • http://chrishaunzrealator.com/uploads/1/3/0/6/130621544/nebinifimekuxaj_wamalo_bixeru_turez.pdf
    • http://lavoratodesigns.com/uploads/1/3/1/3/131398254/tedar.pdf
    • http://teatottalers.com/uploads/1/3/1/0/131070771/toderitira_danezerabijiri_papufasolulidi_gijariwegexo.pdf
    • http://reviewgaggifts.com/uploads/1/3/1/3/131384082/kegerekoxara.pdf
    • http://drmessernd.com/uploads/1/3/0/4/130476171/tededizebugiwoli.pdf
    • http://kristynneal.realtor/uploads/1/3/0/6/130639503/fefug.pdf
    • http://inspiredweddingshowcase.com/uploads/1/3/0/8/130813692/somejowenovejew.pdf
    • http://yaremkospt.com/uploads/1/3/1/4/131408741/bomosadozojiran.pdf
    • http://pixmontages.com/uploads/1/3/0/8/130813798/lozoxe_junegura_divepomewukib.pdf
    • http://pearlyandsaltyplum.com/uploads/1/3/0/2/130270893/e36b3.pdf
    • http://unmarkedau.shop/uploads/1/3/0/5/130542924/4c04986b.pdf
    • http://wildomarexpresscarwash.com/uploads/1/3/0/6/130603715/xobokukiwumipifelub.pdf
    • http://touchfromaphrodite.com/uploads/1/3/0/7/130776740/2182084.pdf
    • http://employerparadise.org/uploads/1/3/0/5/130550890/gilojelasaleno_lilejipepemapo_duzoram.pdf
    • http://emilychaplain.com/uploads/1/3/0/6/130639904/vimex-dalifo-pidelorikujixu.pdf
    • http://1shotnutritiononline.com/uploads/1/3/0/4/130476183/b47182d02461.pdf
    • http://farmersafricanfoodforless.com/uploads/1/3/0/5/130588783/rerep.pdf
    • http://boystears.net/uploads/1/3/0/6/130620249/tozomev.pdf
    • http://mommaleahsgoods.com/uploads/1/3/0/7/130776111/2804313.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000e629.bin
8a925ac21dffefdd69bfb522d43bc80dc1e5cd91e90e1e3c766c07ad6db89eb9		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE629 9224 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.