Malicious PDF — malware analysis report

Static analysis result for SHA-256 86c2cc3bef356a27…

MALICIOUS

PDF

65.6 KB Created: 2020-04-01 21:24:24 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8b751c0dc4d346cbdc656d7761729da7 SHA-1: e0c9ccb7fed9c0f66b37ebbc97d9bff9d8ccbb0b SHA-256: 86c2cc3bef356a279f35634964816e18c8d7962c65f1e57ec11e381bb798ce13
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm or SEO poisoning tactic. The document body also contains urgency lures like 'account will be terminated' and 'action required within 24 hours', combined with a link to a 'service marketplace'. This indicates a phishing or scam attempt designed to trick users into clicking the embedded links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adventuresbyprice.com/uploads/1/3/0/7/130776895/130776895.html#service+marketplace+sap+notes
    • http://jessrledd.com/uploads/1/3/0/2/130272506/sanelas.pdf
    • http://electronicsecurityconsultant.com/uploads/1/3/0/8/130814584/totuguja_kokibe_pejafafusof.pdf
    • http://lollicakesbakery.com/uploads/1/3/0/3/130324030/f345912bc9.pdf
    • http://bswheadworks.com/uploads/1/3/1/4/131437926/negut_bakijubemo_lizititubuwibut.pdf
    • http://fisherdecor.com/uploads/1/3/0/6/130639887/vejara.pdf
    • http://2brotherscc.com/uploads/1/3/0/5/130589103/51353.pdf
    • http://karimdudum.com/uploads/1/3/0/6/130620506/tatujejiw.pdf
    • http://goodboyfloat.com/uploads/1/3/1/3/131382248/4953285.pdf
    • http://windkiststudio.com/uploads/1/3/0/5/130545278/bofamibusux_jeranuzonesibi_niguloluxil_muliligetovijir.pdf
    • http://cameliascanlon.com/uploads/1/3/0/8/130874161/toluwovifonenilok.pdf
    • http://coreenergysolutions.com/uploads/1/3/0/6/130604292/nodelusa_fumat_fisovu_pawijesadajiru.pdf
    • http://simplicityinliving.com/uploads/1/3/0/4/130435503/1924333.pdf
    • http://outfitcoach.de/uploads/1/3/0/6/130604361/83099dc14e2.pdf
    • http://www.junkcleaningpros.org/uploads/1/3/1/3/131383764/9604347.pdf
    • http://auveratech.net/uploads/1/3/0/8/130873846/radow.pdf
    • http://raisedeadpeople.com/uploads/1/3/0/5/130588663/1874692.pdf
    • http://redribbonstaging.com/uploads/1/3/1/4/131483293/verobojetogo-fosulopofuxakut.pdf
    • http://medicalsupplypartnersinc.com/uploads/1/3/0/6/130621093/6359404.pdf
    • http://i-nine.com/uploads/1/3/0/4/130436415/73f818bef2bd31.pdf
    • http://littleshoesgin.be/uploads/1/3/0/6/130605019/5495874.pdf
    • http://danishamericanheritagesociety.org/uploads/1/3/0/5/130588659/penaluwebewi.pdf
    • http://grfinancial.net/uploads/1/3/1/3/131384468/bobeladukufufakimob.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000d755.bin
17a9fe03ad0bfdf1cfae12f69f801f7a6c1af7bd1b6053a3bcbb10ad637d4eb3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xD755 8544 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.