Malicious PDF — malware analysis report

Static analysis result for SHA-256 9560b374b8e7e4c4…

MALICIOUS

PDF

47.5 KB Created: 2020-03-11 08:39:02 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bf27b1a6acd6faba401d00508405b64e SHA-1: d5e4b50133da65d22377dd79febebe0a8e53c01f SHA-256: 9560b374b8e7e4c405ca43646c4bd9c1a4bec3793349fa4f6a95df1ead88bacb
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic PDF_SEO_LINK_FARM indicates that the PDF contains a mass external link farm, with 30 links pointing to various subdomains. The document body contains text related to 'Calf muscle tear treatment nhs', which appears to be a lure to make the document seem legitimate. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fun2gotravel.voyagerwebsites.com/uploads/1/3/0/4/130483125/130483125.html#calf+muscle+tear+treatment+nhs
    • http://icelandbeyond.co/uploads/1/3/0/4/130483426/764006.pdf
    • http://www.christinamaupin.com/uploads/1/3/0/5/130545818/muluvibubufoxaj_mogebetitexebuv.pdf
    • http://cindycharlesouellette.com/uploads/1/3/0/5/130540592/lonagised-roxuda.pdf
    • http://mail.thevincentyee.com/uploads/1/3/0/4/130488621/momudurusegaxukowez.pdf
    • http://dippedbytoria.com/uploads/1/3/0/2/130289603/tokafukel_lubonazifuvekur_vosafubak.pdf
    • http://chexspecialist.com/uploads/1/3/0/3/130379194/megobifuv_gomipilebijo.pdf
    • http://adolfshitler.com/uploads/1/3/0/5/130550882/6240078.pdf
    • http://blackgypsymamawagon.net/uploads/1/3/0/6/130621361/7162384.pdf
    • http://groundinggrouse.com/uploads/1/3/0/7/130740340/a67bb4e8be.pdf
    • http://theloveboxcompanyonline.com/uploads/1/3/0/6/130639172/vibosuvaxa.pdf
    • http://www.themilkcart.co.uk/uploads/1/3/0/8/130813779/janesomak.pdf
    • http://www.lifeongo.com/uploads/1/3/0/4/130490221/7493139.pdf
    • http://athleteimprovementacademy.com/uploads/1/3/0/2/130289809/abfc9ce2.pdf
    • http://www.retaso.com/uploads/1/3/0/2/130289601/aacf90.pdf
    • http://corningfishandgame.org/uploads/1/3/0/7/130776460/4eaa8eca84d1b.pdf
    • http://alektoinc.com/uploads/1/3/0/2/130289776/316890.pdf
    • http://kingscustomwoodworking.com/uploads/1/3/0/7/130775928/3414351.pdf
    • http://blakedigitalmarketing.com/uploads/1/3/0/3/130313363/nuwulo-wudog-jimum-ruzudi.pdf
    • http://bearvsbaby.org/uploads/1/3/0/8/130814186/pomilevonasob_wafomajelidabu_suxefalo.pdf
    • http://cahabagrand.com/uploads/1/3/0/3/130379285/nokijozimoxixudafaj.pdf
    • http://ttcasfriendsandfamily.org/uploads/1/3/0/3/130323092/wepomitemisoxet_pabuvopu_kolodixepovefet.pdf
    • http://drifft.com.au/uploads/1/3/0/6/130603890/013d8c6.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000091ec.bin
b117bc6bd80872c392c7af8aae57bcdd304d3729a6532a99c0f805d57c541d06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x91EC 8048 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.