Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d3cfc23abf09dd1…

MALICIOUS

PDF

45.1 KB Created: 2020-05-16 19:54:40 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 19e034240bd8f69aecf9d55f52ae067c SHA-1: 17abc42baf52fe522c5795fb8f57f6fba08545b7 SHA-256: 7d3cfc23abf09dd18035dd61c8b19db9b790ec87fc3d3038818ed2b6c5e124dd
190 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF file contains numerous external links disguised as content related to an 'Airtel prepaid recharge app' and other lures. Heuristics indicate a suspicious link farm and parser evasion techniques, suggesting the primary goal is to redirect users to malicious websites. The document body, though partially corrupted, contains fragments of URLs and mentions of urgency, reinforcing the phishing or malware distribution intent. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 8

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Clickable PDF combines external action with parser-evasion structure high PDF_ACTION_PARSER_EVASION
    PDF has an external clickable URI together with object graph or xref structures that make parsers disagree, such as divergent duplicate objects, parser divergence, or xref offset mismatch. That combination is stronger than a plain link: the document is both an outward-action carrier and a parser-confusion/evasion sample.
  • QR-code redirect lure medium SE_QR_LURE
    Document instructs the user to scan a QR code with a phone — consistent with QR phishing, but also common in legitimate documents
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gregjiel.com/uploads/1/3/1/3/131379029/131379029.html#airtel+prepaid+recharge+app
    • http://cprenovations.ca/uploads/1/3/1/4/131438888/niduxa.pdf
    • http://futuretranquilityproperties.org/uploads/1/3/0/5/130546971/ec14b2a159.pdf
    • http://looksbeautyandnails.nl/uploads/1/3/0/2/130288383/dazemale.pdf
    • http://alisonic.net/uploads/1/3/1/4/131452845/7728347.pdf
    • http://ladieslearnenglish.com/uploads/1/3/1/4/131454549/teredujojetebalobaki.pdf
    • http://punchlistms.com/uploads/1/3/1/0/131070846/wonuvumomip.pdf
    • http://setransformations.com/uploads/1/3/1/3/131398515/da6eaca.pdf
    • http://thinkredcreatives.com/uploads/1/3/1/3/131379037/b8f7a77581451.pdf
    • http://pulleyslearningacademyand.com/uploads/1/3/0/7/130740443/1101673.pdf
    • http://hemphealthco.com/uploads/1/3/0/8/130873995/e3b956ce.pdf
    • http://clearcalmbreathe.com/uploads/1/3/0/5/130543488/vutujufi_tobefowebumakuw_ligunegozugura.pdf
    • http://scottcmatsonllc.com/uploads/1/3/0/7/130775443/6802298.pdf
    • http://onlinesecurityservice.site/uploads/1/3/0/5/130589389/fa7337549e4b339.pdf
    • http://fancynancyshousecleaning.com/uploads/1/3/1/3/131398567/d0c423622068dd8.pdf
    • http://iammattcruz.com/uploads/1/3/0/7/130738771/4158429.pdf
    • http://kidds-corner.com/uploads/1/3/1/4/131454352/5814425.pdf
    • http://ehousere.net/uploads/1/3/1/8/131872058/jepimo.pdf
    • http://shipyourshape.com/uploads/1/3/1/3/131380466/6912718.pdf
    • http://envisionnepal.org/uploads/1/3/0/4/130488227/gaxuduw.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006cbb.bin
40096842c6a76ddb7da799c82e9bea11832d59fcceaeb5724d9fc1971b1bd518		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CBB 11248 bytes
font_01_sfnt_off00009330.bin
ebd2804bff382343e08f6a42dc45f69f4e794c08b23908ae60ba78ededae74b1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9330 16164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.