Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e880c0ca0ec710b…

MALICIOUS

PDF

54.5 KB Created: 2020-05-23 04:45:26 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 3cdfbac5c519cf9e8c11aa2d9a23e6ca SHA-1: 2a88b6853fc47459801b02a6b472062baef5f3e9 SHA-256: 4e880c0ca0ec710bdb40af93c44cd41b38513897db3ac811b8aecd3d2059d990
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which are numerically or generically named, indicative of a link farm or SEO manipulation tactic. The presence of urgency language ('account will be terminated', 'action required within 24 hours') further suggests a phishing or social engineering attempt. The primary goal appears to be directing users to potentially malicious external resources.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://realavier.com/uploads/1/3/1/4/131406785/131406785.html#dark+souls+parry+sound
    • http://greensince78.com/uploads/1/3/1/4/131406154/nilokodakareb.pdf
    • http://sarahbalisalisa.com/uploads/1/3/0/6/130620783/aad8ba3cbf8f86.pdf
    • http://misalsa.org/uploads/1/3/1/4/131406372/febotusit_kagof_kemomef_repopurabo.pdf
    • http://jeanniegoldfarb.com/uploads/1/3/0/2/130270934/4917891.pdf
    • http://kernneuroscienceconsulting.com/uploads/1/3/1/3/131380828/d347a335.pdf
    • http://mta-sts.mail.blackandpetrichor.com/uploads/1/3/1/8/131871687/koxupiwawumo.pdf
    • http://sarahabigail01.com/uploads/1/3/0/3/130313567/14da7a.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ab15.bin
292e5830979889861fd17235027a08fc402ab2bef4a76f2622255421a4b31b37		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAB15 10644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.