Malicious PDF — malware analysis report

Static analysis result for SHA-256 a505e524767bd165…

MALICIOUS

PDF

37.9 KB Created: 2020-04-06 06:41:53 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 94185ffbaece1ab163082489d61826c7 SHA-1: bfff20af173cecd7d834f8daf9405d99414e0e0a SHA-256: a505e524767bd16599f35a18ee4635c809513aebc7cd81f701bc104e9086b402
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a "Download Now" lure and a large number of external links to other PDF files, indicating a link farm designed to attract traffic or distribute further malicious content. The primary URL suggests a lure for downloading Microsoft Office software. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theundergroundnetwork.com/uploads/1/3/0/3/130379681/130379681.html#download+microsoft+office+2013+home+and+student+trial
    • http://solidusphotography.com/uploads/1/3/0/6/130605044/bumase.pdf
    • http://climpact.store/uploads/1/3/0/2/130289400/tabezi_lumufa_basiwilugif.pdf
    • http://alexandriasdreambirdtoys.com/uploads/1/3/1/3/131380583/d651c37.pdf
    • http://irishshepherds.com/uploads/1/3/0/7/130776196/2391531.pdf
    • http://bulverdepregnancy.net/uploads/1/3/0/7/130776100/pumoxomalidevizak.pdf
    • http://yestoyouthgala.org/uploads/1/3/0/7/130739416/8b3b5.pdf
    • http://deena4.org/uploads/1/3/0/6/130639630/voxomani.pdf
    • http://karmatutors.com/uploads/1/3/1/0/131070131/e357f.pdf
    • http://therealsolutionsllc.com/uploads/1/3/0/7/130775339/zoxilusaxebekutil.pdf
    • http://thebeatsutra.com/uploads/1/3/1/4/131406234/zixapisikogefumam.pdf
    • http://skylerdeckard.com/uploads/1/3/0/8/130814531/deduvijufone-tidavuxasi-kugujemuli.pdf
    • http://strootmanfotografie.nl/uploads/1/3/0/6/130639710/mexumixafogizotigi.pdf
    • http://mirandaanddevon.com/uploads/1/3/0/8/130874473/9326596.pdf
    • http://legenddrywallpdx.com/uploads/1/3/1/3/131380609/8101909.pdf
    • http://burnersanonymous.org/uploads/1/3/0/3/130323527/vodimov_kawatisexe_mupuwapufifutum.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006934.bin
db9b242ac29409b8e1c2399afc1559f62fc09117c8928f2d9000ce2c3d76af95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6934 8000 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.