Malicious PDF — malware analysis report

Static analysis result for SHA-256 80f6d7f2480c80d5…

MALICIOUS

PDF

18.2 KB Created: 2020-04-07 07:19:15 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6ec60aaf4d7d724c02ea2fb0bd5ccb75 SHA-1: 874359cee6b2cde844010013dd4796b82d6f0ba3 SHA-256: 80f6d7f2480c80d52b6dfb7c91d41bd0daddb06bea973b030d4b89a62fe419a5
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as a screenshot lure, containing minimal text and a single image, designed to trick users into clicking an external link. The document body contains a link to 'sts-florida.net' and the PDF itself hosts a large number of external links, many pointing to 'itzysauto.com', suggesting a link farm or redirection mechanism. No scripts were extracted, but the structure strongly indicates a phishing or credential harvesting attempt.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sts-florida.net/uploads/1/3/0/2/130270986/130270986.html#teste+de+cultura+generala+geografie+online
    • http://itzysauto.com/uploads/1/3/0/2/130289681/29c7fcf3f0e43c.pdf
    • http://katemcdannold.com/uploads/1/3/0/7/130739173/pirubas.pdf
    • http://palomboperformancecollection.com/uploads/1/3/0/4/130489417/64bd8b9f8bc96b.pdf
    • http://graceknysna.org/uploads/1/3/1/3/131383973/73c8914a4ee.pdf
    • http://tiffandtwocubs.com/uploads/1/3/1/1/131164545/gupisivunaleve-lurejoniwod-zunarovologogok.pdf
    • http://artshop13.com/uploads/1/3/0/6/130639905/tovamoko.pdf
    • http://deescustomizinganddesigns.com/uploads/1/3/0/5/130539763/tikuxix_nokaroti_fogijig_lawemobeta.pdf
    • http://retailsourcingconsultants.com/uploads/1/3/0/9/130969829/mesevira.pdf
    • http://baxterbehavioralhealth.com/uploads/1/3/0/8/130814636/874d2c6cd6ed3.pdf
    • http://sarahgeri.com/uploads/1/3/0/6/130603783/gagupatoze.pdf
    • http://affiliateprepaid.com/uploads/1/3/0/7/130776655/c5e64d941b6.pdf
    • http://ndvrusa.org/uploads/1/3/0/2/130270847/sosenasisefusoralon.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.