Malicious PDF — malware analysis report

Static analysis result for SHA-256 abb2bcf8f5e46e05…

MALICIOUS

PDF

43.6 KB Created: 2020-03-10 13:18:09 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 1371791116a0143c569792e4d967d407 SHA-1: 8e6a7377680341a183390851308a71bdb14f4232 SHA-256: abb2bcf8f5e46e050a7668c2ea366de9d1a376a6f8f2d9cfd663120d583e7299
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a link farm with numerous external URLs, disguised as a KPMG aptitude syllabus. The primary URL, http://the-smith-family.rominastiebenphotography.com/uploads/1/3/0/7/130775145/130775145.html#kpmg+aptitude+syllabus, is likely intended to redirect the user to a malicious site. The heuristic PDF_SEO_LINK_FARM indicates a large number of generated links, suggesting a common SEO poisoning or link farm tactic.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://the-smith-family.rominastiebenphotography.com/uploads/1/3/0/7/130775145/130775145.html#kpmg+aptitude+syllabus
    • http://soulreviver.com/uploads/1/3/0/2/130274109/f2db61.pdf
    • http://403amazingfinds.com/uploads/1/3/0/7/130775197/zopafi-nejinovinilu-tegugifopuponar.pdf
    • http://mmaninja.net/uploads/1/3/0/5/130545194/2364420.pdf
    • http://mail.lirosgallery.com/uploads/1/3/0/6/130605115/wufuxemaleganaguxora.pdf
    • http://yogaatyourplaceorours.com/uploads/1/3/0/7/130776260/pubusebolorezinatode.pdf
    • http://paulgreenwoodactor.com/uploads/1/3/0/6/130604421/f4b1d318297aeb7.pdf
    • http://interdependence.info/uploads/1/3/0/6/130639368/5237338.pdf
    • http://cottageandcheese.com/uploads/1/3/0/8/130813903/zujodazogilizozilimu.pdf
    • http://dezignkulcha.com/uploads/1/3/0/5/130588343/fakodebutefujejutase.pdf
    • http://facrfoundation.com/uploads/1/3/0/3/130313670/2786638.pdf
    • http://www.themindfulsanctuary.com/uploads/1/3/0/2/130272918/kowefezigi.pdf
    • http://www.almedfaa.com/uploads/1/3/0/5/130543210/bd5cf78efb32784.pdf
    • http://kenstringerconsulting.com/uploads/1/3/0/6/130639461/2586357.pdf
    • http://premedpursuit.com/uploads/1/3/0/5/130588478/besut-dafabixopet-dibenejoxav-kuzikedojurobex.pdf
    • http://cinno.ca/uploads/1/3/0/6/130640051/kogezes_vinotoliri.pdf
    • http://serve.apptekgroup.com/uploads/1/3/0/7/130775031/tuxixilakezanulo.pdf
    • http://swietkowskilaw.com/uploads/1/3/0/4/130489958/xutepi.pdf
    • http://salinastowing.com/uploads/1/3/0/3/130313150/9120827.pdf
    • http://www.w3ministries.com/uploads/1/3/0/9/130969103/tipefofiriliva-kokor-nokazupekekujuv.pdf
    • http://andrewflemingmedia.com/uploads/1/3/0/8/130813453/e67ac.pdf
    • http://inlinevisionbysj.com/uploads/1/3/0/4/130476207/7fa1017b620dcc9.pdf
    • http://imaginaryinetwork.com/uploads/1/3/0/3/130323421/9530417.pdf
    • http://kylefoxagency.com/uploads/1/3/0/7/130739755/943e9f3ae8767.pdf
    • http://tamarko.com/uploads/1/3/0/7/130739405/jegapalivibuli.pdf
    • http://shorejunction.nz/uploads/1/3/0/6/130620150/fekirexotaxasoguvo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007fc5.bin
91703b3314be02ca48189e6638b02e3e905bac8fceb70576a7377fcac76c5c46		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7FC5 8632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.