Malicious PDF — malware analysis report

Static analysis result for SHA-256 521737703e0dc31a…

MALICIOUS

PDF

128.4 KB Created: 2020-03-29 02:10:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c2eab3fed0b58615766ca9730a10a2d1 SHA-1: 55ab28a7baf9d303bf249f376511205629550456 SHA-256: 521737703e0dc31a14cddcd91db2dd81a838ca3867bcb99657f16241e0c115a7
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document is identified as malicious due to its structure, which includes a large number of external links, a common tactic for SEO manipulation or distributing further malicious content. The document's content and embedded links suggest an advance-fee scam or callback phishing lure, aiming to deceive users into believing they are interacting with official forms or require urgent action. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nuggets.space/uploads/1/3/1/1/131164270/131164270.html#judicial+council+form+civ-100
    • http://www.fenixgraniteandmarble.com/uploads/1/3/0/7/130775269/domulupugo_mezunogube_vukav.pdf
    • http://bergerondodge.com/uploads/1/3/0/4/130489248/fodenojaw.pdf
    • http://www.ssgesports.com/uploads/1/3/0/8/130813528/tebizatoke.pdf
    • http://melindaconnor.net/uploads/1/3/0/7/130738893/tunakuvuvopuzojagad.pdf
    • http://woodmerehomes.net/uploads/1/3/1/3/131379939/gofifotilak_noviviguw.pdf
    • http://greeneaglellc.com/uploads/1/3/0/5/130589243/592b7b42a5f3d73.pdf
    • http://cmconsultancyservices.com/uploads/1/3/0/6/130620556/vojalupa.pdf
    • http://lamplify.org/uploads/1/3/0/6/130604074/c03ab54.pdf
    • http://infinequity.net/uploads/1/3/0/5/130588477/zabege.pdf
    • http://mianfeidoudizhu.br3h.com/uploads/1/3/0/5/130551949/510139.pdf
    • http://deanvukelicstonemason.com/uploads/1/3/0/6/130620794/wotugebibozejoz.pdf
    • http://kisha-allure.com/uploads/1/3/0/6/130621643/575813.pdf
    • http://pluscarts.com/uploads/1/3/0/4/130478067/xirofi.pdf
    • http://hostmaster.heatherioneharding.com/uploads/1/3/0/7/130739212/zibajejovura_bureta_pigave_fajupepepafebeb.pdf
    • http://seniorsalliance.org/uploads/1/3/0/5/130589337/44b4f.pdf
    • http://mysimplyblingfor5.com/uploads/1/3/0/7/130775830/a7fb93c7f0f95.pdf
    • http://lenka-photography.com/uploads/1/3/0/5/130551700/velafakobiti.pdf
    • http://kennedystudios.com/uploads/1/3/0/6/130621282/345188.pdf
    • http://albertedwardhops.com/uploads/1/3/0/3/130379081/3cdcbfef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001d0f9.bin
fb9af28ebf908436c3a26cce8d42f788faeaad24d7ab61b96f345018a0f92e18		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D0F9 8892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.