Malicious PDF — malware analysis report

Static analysis result for SHA-256 8cd993e23270cefa…

MALICIOUS

PDF

52.8 KB Created: 2020-03-28 14:00:52 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8a2c6bed7d5693458cf66b164ec34715 SHA-1: 72e7b0cfd59d0deb5938f389473336b952a3120a SHA-256: 8cd993e23270cefad64a5e2bd8ac05230f0ed087a5717f335acab05824c78d61
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, characteristic of a link farm or SEO spam technique. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' suggests that the document may also instruct users to open a password-protected archive, a common tactic to bypass gateway security. The embedded URLs likely serve to redirect users to malicious websites or phishing pages.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rapidpermitreviewhawaii.com/uploads/1/3/0/8/130874530/130874530.html#john+the+ripper+linux+syntax
    • http://www.globalgardenfarm.com/uploads/1/3/0/8/130814714/4a827.pdf
    • http://floydcountyproductions.com/uploads/1/3/0/6/130639607/153a1d9bcc5b8a.pdf
    • http://parkermultisport.com/uploads/1/3/0/8/130814774/kitovodokod.pdf
    • http://mlachomes.com/uploads/1/3/0/6/130621657/dodebobibiru-wiluvukomukuj.pdf
    • http://azimutsinternational.org/uploads/1/3/0/6/130604812/328ab769a.pdf
    • http://vineyard-blue.com/uploads/1/3/0/5/130551229/bumelalumibonev.pdf
    • http://greater.group/uploads/1/3/0/4/130436362/dumagitotituv.pdf
    • http://server.jesusradicals.com/uploads/1/3/0/5/130590738/11585e81b9bb2d.pdf
    • http://www.handsareforhealing.org/uploads/1/3/0/6/130604557/7796821.pdf
    • http://dear-eva.com/uploads/1/3/0/6/130621093/pugunidivo.pdf
    • http://mx.sissybella.com/uploads/1/3/0/5/130588345/debofexutokakita.pdf
    • http://egro.studio/uploads/1/3/0/9/130969474/wixipupumutu.pdf
    • http://kapecoalition.com/uploads/1/3/1/0/131071210/111eb720fcdb5a.pdf
    • http://mydigitaldiva.net/uploads/1/3/0/2/130271132/04f70db35.pdf
    • http://purplepipes.co/uploads/1/3/0/8/130813524/7a94c455.pdf
    • http://braydenlex.com/uploads/1/3/0/7/130739067/gamunazem.pdf
    • http://melissamcnutt.com/uploads/1/3/0/7/130775436/defipuravivaxifu.pdf
    • http://markhmccormack.com/uploads/1/3/0/6/130605182/6682803.pdf
    • http://georgiaeyesmusic.com/uploads/1/3/0/8/130874564/880259e6.pdf
    • http://encanaplanophotos.com/uploads/1/3/0/5/130543684/364016.pdf
    • http://openmrinearme.com/uploads/1/3/0/2/130272250/4601977.pdf
    • http://maryloulenhart.com/uploads/1/3/0/7/130776026/8631670.pdf
    • http://bevaraweb.com/uploads/1/3/0/6/130621201/4998650.pdf
    • http://johnspencermusic.com/uploads/1/3/0/5/130589237/lifakut_motugeboku.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a1db.bin
33e3ab7a1a211f89e2f98392a0c046e69a5ec7a5dda2a07f437525aeb2d0f098		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA1DB 9196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.