Malicious PDF — malware analysis report

Static analysis result for SHA-256 80d4d1212a5fb2e4…

MALICIOUS

PDF

44.6 KB Created: 2020-04-02 17:14:17 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5d71c1e4fe7d0d53bb7590756202ab62 SHA-1: 61968d8258a947f2b240264b80f2361976922655 SHA-256: 80d4d1212a5fb2e4623672d56302a834e055d4e1f72579c227c58ecdabab6022
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text related to 'Vampire the Masquerade 20th Anniversary Edition clans' and mentions the authoring application 'wkhtmltopdf', suggesting a lure to external content. The primary attack pattern involves directing users to a multitude of potentially malicious or SEO-abused websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://breannesiwicki.com/uploads/1/3/0/8/130813975/130813975.html#vampire+the+masquerade+20th+anniversary+edition+clans
    • http://ccccloset.org/uploads/1/3/0/3/130323962/a39ccf8.pdf
    • http://greycoinc.com/uploads/1/3/0/8/130874325/bupokegak.pdf
    • http://remiddelalderdager.com/uploads/1/3/0/2/130289734/6264066.pdf
    • http://dvtechautomotive.com/uploads/1/3/0/7/130775013/dibarawozatapim.pdf
    • http://zajeljo.com/uploads/1/3/0/6/130603810/rinojifemitasa.pdf
    • http://fearfullyfierce.com/uploads/1/3/0/8/130873997/839212dce085552.pdf
    • http://retail-mommy.com/uploads/1/3/1/3/131384240/5199436.pdf
    • http://carexlakewood.com/uploads/1/3/0/6/130620274/a790823.pdf
    • http://valleycreekcustomdesigns.com/uploads/1/3/0/6/130639197/83caa0ae.pdf
    • http://frenchfarland.com/uploads/1/3/1/4/131406809/2df160738ae.pdf
    • http://ceadethiopia.com/uploads/1/3/0/8/130814176/nomename_ronexebuduruto_dalotataxasike_mejanatoz.pdf
    • http://jorgebailey.com/uploads/1/3/0/5/130588518/tiwug.pdf
    • http://slockettdesigns.com/uploads/1/3/0/8/130874492/ee210aa98.pdf
    • http://thepivotmap.com/uploads/1/3/0/7/130739107/1603230.pdf
    • http://mail.amboy.net/uploads/1/3/0/8/130813818/pepovijur-fonaga-finepa-bidufesisoz.pdf
    • http://aquamanagementsystems.com/uploads/1/3/0/6/130639254/34a8ac5a.pdf
    • http://candlelicious.com/uploads/1/3/0/6/130604649/konanig_banusuropizuvu_ratexug_vasejuwexelewu.pdf
    • http://snout.blog/uploads/1/3/1/3/131381677/vigitujunemuzo.pdf
    • http://thecreativetrap.net/uploads/1/3/0/7/130775791/misak.pdf
    • http://boostfoundationinternational.com/uploads/1/3/1/3/131379524/razebafidide.pdf
    • http://hpitconsulting.com/uploads/1/3/0/6/130639370/a0a39db62e.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e2e.bin
720e76a3e56c2144998e511a924dc3ef89c6e8c822701420a61e0d94b94b8bbf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E2E 7488 bytes
font_01_sfnt_off00009bae.bin
e91619dfd4c72a85464d95ef1ba4e67df13020651c42071bafbe521a61d9f7fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9BAE 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.