Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad3c769c0f67a9f6…

MALICIOUS

PDF

44.0 KB Created: 2020-03-27 09:50:45 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 8dd7aed4cbfdf161805f80ef66c71020 SHA-1: 62340afbe5a8f962759d2c0f671528509646fce1 SHA-256: ad3c769c0f67a9f68db358fae13292bb0bf612d9932fb6ddcda791e38545348b
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF contains numerous external links, indicating a link farm or SEO spamming operation. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests that the document may contain instructions for executing commands, potentially to download or execute further payloads. The presence of multiple external URLs, including one that appears to be a product specification, points towards a social engineering tactic to drive traffic to malicious sites.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://731electro.com/uploads/1/3/0/8/130874326/130874326.html#dragon+touch+a1x+plus+specs
    • http://homefrontinvestingllc.net/uploads/1/3/0/4/130493968/luwajodopunu.pdf
    • http://sorsmarketing.com/uploads/1/3/0/8/130874264/fb8167f800cd.pdf
    • http://lgnrg.net/uploads/1/3/0/2/130270847/virokofipop.pdf
    • http://kinkycurlyweaves.com/uploads/1/3/0/6/130640024/51de1.pdf
    • http://nodoubthomeinspection.com/uploads/1/3/0/6/130604731/fojuxotigo.pdf
    • http://www.sfolimo.biz/uploads/1/3/0/5/130590308/e389fcccf910.pdf
    • http://silverspurcamp.com/uploads/1/3/0/6/130620265/3193206.pdf
    • http://www.homelanddefenseconsultants.com/uploads/1/3/0/5/130588962/3add10723.pdf
    • http://denvercreativeservice.com/uploads/1/3/0/5/130588687/383ab0c7b222c.pdf
    • http://radiumfundllc.com/uploads/1/3/0/2/130287504/sexadekana.pdf
    • http://chrisdelany.com/uploads/1/3/0/7/130775032/45266e0bff7.pdf
    • http://helpgarret.life/uploads/1/3/0/3/130313144/1500088.pdf
    • http://fitnessmanagementgroupbda.com/uploads/1/3/1/3/131379042/9352517.pdf
    • http://getifi.com/uploads/1/3/0/7/130739021/1812369.pdf
    • http://www.nutrimbc.com/uploads/1/3/0/7/130740550/vezalijalufufuvanu.pdf
    • http://lindseymarina.com/uploads/1/3/0/8/130873976/wivafu_desexusider_zaxufegeno_somodevajapapek.pdf
    • http://newthoughtmanifesting.com/uploads/1/3/0/5/130550928/9386902.pdf
    • http://schulzlegal.ca/uploads/1/3/0/3/130323814/dinikuzenen-novofusu-rugimaza.pdf
    • http://wundrmediapro.com/uploads/1/3/0/5/130551023/fulimogisunub_bogek.pdf
    • http://porchlighthub.com/uploads/1/3/0/8/130874115/9610354.pdf
    • http://rawopal.com/uploads/1/3/0/5/130590059/xamexetokukenibav.pdf
    • http://towntaxservices.com/uploads/1/3/0/2/130272606/22857bc078e.pdf
    • http://detroitrealestateexpo.com/uploads/1/3/0/5/130541641/wilanejimudekise.pdf
    • http://soghat.eu/uploads/1/3/0/6/130604656/7768586.pdf
    • http://full.rahelmusic.com/uploads/1/3/0/3/130313728/d040ed64c97.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007b5a.bin
6e502d74c180adc04381bc8f95955c15a17f9eef8251cba3b042daaffc964fb8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7B5A 7492 bytes
font_01_sfnt_off000098be.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0x98BE 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.