Malicious PDF — malware analysis report

Static analysis result for SHA-256 8152bfcac9605b69…

MALICIOUS

PDF

48.1 KB Created: 2020-04-27 06:22:22 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 442a3c2afa072356a5b8432e52f0dcbb SHA-1: 80226b8adfd69169ec1e58ac1c2ae35ab9341b97 SHA-256: 8152bfcac9605b69d3b75de017194880b0f7ec73618873efa66caf0f56f5cb44
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files, suggesting a link farm or SEO abuse tactic. The document body contains a reference to 'Blackjack game apk' and a 'Download Now' lure, indicating a potential phishing or malware distribution attempt. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deceptivelysimple.com/uploads/1/3/0/8/130874119/130874119.html#blackjack+game++apk
    • http://birminghamgarageshapeups.com/uploads/1/3/0/7/130740022/jelupap-dogidojuwoza-falojafol.pdf
    • http://booksbooksandusbornebooks.shop/uploads/1/3/1/4/131406105/2cbbd2f5455.pdf
    • http://wembajourney.com/uploads/1/3/0/3/130379424/2413699.pdf
    • http://kris-bud-podkarpackie.pl/uploads/1/3/0/5/130551625/gisubuzaxijawuf.pdf
    • http://greenehempcompany.store/uploads/1/3/0/2/130270753/7193834.pdf
    • http://miamimetalworks.com/uploads/1/3/1/4/131454656/wekezafimo.pdf
    • http://esploritalia.com/uploads/1/3/0/5/130588500/4895310.pdf
    • http://atlanta-craft.best/uploads/1/3/0/9/130969632/39118.pdf
    • http://motorundolivenoel.de/uploads/1/3/1/1/131164114/fetulis.pdf
    • http://cleanshot.net/uploads/1/3/0/7/130775645/damepalofufomudus.pdf
    • http://blackoxdesigner.com/uploads/1/3/1/3/131398066/2dbe3181e7e2.pdf
    • http://atlanta-craft.best/uploads/1/3/0/9/1309
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000735f.bin
b709596409757cc09d379e1a39f334d294aca594177221c872acb70fece4d693		 pdf-font-stream PDF embedded font (sfnt) at offset 0x735F 8364 bytes
font_01_sfnt_off000093b7.bin
235e61a47a0bfe1dd14ea0d3a8b0c00203dd87a6217755dbf198a4ca40dd8353		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93B7 3328 bytes
font_02_sfnt_off00009f55.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9F55 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.