Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e5ebbdf40163fc1…

MALICIOUS

PDF

42.0 KB Created: 2020-05-07 13:14:16 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bd9fd34b7c79dfbc59b15626cb55ef2e SHA-1: 7bed0919a111e0e98f2be8ae120893e5cc71ec7c SHA-256: 8e5ebbdf40163fc17058f248252ca2a15a5a1d1e6da51f99751d86e08b103d0d
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, indicative of a link farm, and is flagged as a lure for an advance-fee scam. The document body, though partially corrupted, contains text related to 'Warranty deed illinois form' and references to wkhtmltopdf, suggesting it's designed to appear as a legitimate form. The presence of multiple external URLs, including one pointing to 'ciggysound.com' with a similar form name, reinforces the likelihood of a phishing or scam attempt.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ciggysound.com/uploads/1/3/0/8/130813539/130813539.html#warranty+deed+illinois+form
    • http://mta-sts.clarksburgcc.org/uploads/1/3/0/3/130313434/xowewabe.pdf
    • http://betterworldbetterfuture.com/uploads/1/3/0/2/130287873/nuzorif-turomilagidu.pdf
    • http://karenjrohrlach.com/uploads/1/3/0/5/130551197/2677374.pdf
    • http://shownosocks.com/uploads/1/3/0/2/130287281/9090380.pdf
    • http://compassionatecomms.com/uploads/1/3/0/5/130539987/3048985.pdf
    • http://the-mt-health.com/uploads/1/3/0/7/130775747/e4fbc28498e.pdf
    • http://neurodesignlab.com/uploads/1/3/0/5/130543468/16abfb1a170819.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007747.bin
99c162f1d82a4360122efa13ca859b6d2b309dcf838d9e7d2b27cb6c7653d009		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7747 10996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.