Malicious PDF — malware analysis report

Static analysis result for SHA-256 56ca8cded6d807f6…

MALICIOUS

PDF

37.2 KB Created: 2020-04-22 05:26:41 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 7741d7770334bfd27d4a73fb5b0f06df SHA-1: 921a230fc83a402f0e49364228a3708e92a7eca2 SHA-256: 56ca8cded6d807f68b929e6336ea8b83ab9cf6c6382e2ceba9b92446fc4d8df9
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a likely attempt to lure users through deceptive content. The document body, though heavily obfuscated, contains references to '2019 calendar template word 2007', suggesting a lure to download or view a template, which is then used to hide the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://boosmithphotography.com/uploads/1/3/0/5/130550789/130550789.html#2019+calendar+template+word+2007
    • http://acause2travel.org/uploads/1/3/0/2/130289218/6177639.pdf
    • http://thetrailrideproject.org/uploads/1/3/0/6/130621218/kuregozalonixuli.pdf
    • http://susancolours.com/uploads/1/3/0/9/130969570/rerud_sufuwedo_jurepilefitawuv_dolelutisu.pdf
    • http://handwriteforme.com/uploads/1/3/1/3/131383373/41338c.pdf
    • http://phoebemakeup.com/uploads/1/3/0/4/130488829/nixavizowo-kuxulavadifop.pdf
    • http://jenpengellyportfolio.com/uploads/1/3/0/4/130436207/pexafifemane.pdf
    • http://sheiskeesh.com/uploads/1/3/0/9/130969341/nupurexavij.pdf
    • http://kalbau-baggerungen.com/uploads/1/3/1/4/131482996/5416649.pdf
    • http://barnyardmuscle.shop/uploads/1/3/0/7/130739084/pikumewiv_zaroboredobe.pdf
    • http://hapticinteractives.com/uploads/1/3/0/7/130740375/5431827.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006795.bin
f8fdfb6eb4ef308c4ce4933aeb1bafe0eefb2d23dc469771e4ce4dde65c7c5c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6795 8808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.