Malicious PDF — malware analysis report

Static analysis result for SHA-256 55889c7f3040d712…

MALICIOUS

PDF

64.7 KB Created: 2020-04-22 00:50:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a3afd928fd9935a133ce3d989facef45 SHA-1: abfafba104053efb0f072caf3963bb5c6efccc4b SHA-256: 55889c7f3040d712200922017be1cb47f04911a2b3d3e271a4ed1937e3e96990
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a lure for 'Azar free gems mod apk' and exhibits a PDF link farm heuristic, indicating a likely attempt to drive traffic to malicious sites. The 'SE_PAYMENT_REDIRECT_LURE' heuristic suggests a business-email-compromise pattern, aiming to trick users into making fraudulent payments or changing bank details. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://puzzlesgameandhobby.com/uploads/1/3/0/3/130323600/130323600.html#azar+free+gems+mod+apk
    • http://areafest.com/uploads/1/3/0/6/130604411/wumomasutij-xodotatazi.pdf
    • http://serenityskinexperts.com/uploads/1/3/0/5/130544746/6473c.pdf
    • http://st-francis-court.com/uploads/1/3/0/5/130542996/b0a9ac869.pdf
    • http://newmusic.net/uploads/1/3/0/6/130639775/8260452.pdf
    • http://customattract.com/uploads/1/3/0/2/130289184/nibavosakop_sufomive_xikadikib_kizozupemilun.pdf
    • http://aria.ca/uploads/1/3/0/7/130776763/bofelisazelu-semogukimape.pdf
    • http://eunbaelee.com/uploads/1/3/1/6/131606420/wugozozolutosudil.pdf
    • http://rtbseo.com/uploads/1/3/0/6/130604716/dc660c44ff619.pdf
    • http://laurafleursilver.com/uploads/1/3/0/7/130775558/sovegozazi.pdf
    • http://jeffreyjpalmer.net/uploads/1/3/0/3/130313643/7933286.pdf
    • http://iowachapter7bankruptcy.com/uploads/1/3/0/9/130969454/podixi-kazimewolu-filok-rirawib.pdf
    • http://rivervalleymetal.com/uploads/1/3/0/4/130435857/sukusososerugibepom.pdf
    • http://rewireyourhealth.com/uploads/1/3/0/9/130969182/zuxozuvevotodev.pdf
    • http://eunbaelee.com/uploads/1/3/1/6/131606420/wugo
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000ad22.bin
f769514a2deae5cf6e06d84ddc88449f92ff7b414c30fb5a5e06b026b732f306		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAD22 8680 bytes
font_01_sfnt_off0000ce56.bin
d9948dc5f738368488e3e9e8781a09547a302acab327b934ebadfec1239af41c		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCE56 3880 bytes
font_02_sfnt_off0000dd42.bin
3a2e6edc6db7e3e70dd34b00f2d5340184231aa06d95136165cc16606f5c4652		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDD42 17924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.