Malicious PDF — malware analysis report

Static analysis result for SHA-256 b58982f7f9a0bb6e…

MALICIOUS

PDF

18.2 KB Created: 2020-03-28 10:05:16 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 84a46c58421c32f31f75a9c4a6d52569 SHA-1: 2d82e782030b1999ec6c791ee30290d0afe1fd8b SHA-256: b58982f7f9a0bb6e9b7f33fa6d1ba13e01de8bcdab71c6c8fba65a7bb9fc4a2e
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, with a primary focus on condivir.com, suggesting a link farm designed to redirect users to malicious content. No scripts were extracted, but the structure and embedded URLs strongly indicate a social engineering attack aimed at tricking users into visiting potentially harmful websites.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 18 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://exercise-4-health.com/uploads/1/3/0/8/130814347/130814347.html#mole+to+mass+stoichiometry+problems+with+solutions
    • http://condivir.com/uploads/1/3/0/6/130620657/3597963.pdf
    • http://mybestbets.org/uploads/1/3/0/4/130483253/6f8fbfcba0.pdf
    • http://medinatransportinc.com/uploads/1/3/0/2/130287965/2660972.pdf
    • http://mail.lisaorrart.com/uploads/1/3/0/5/130544232/nezenatalalezol_laganeru_domasa_sinewov.pdf
    • http://aueservice.com/uploads/1/3/0/2/130273571/rukexoduxuwiwol.pdf
    • http://visionsofadventure.com/uploads/1/3/0/8/130815017/xadug.pdf
    • http://mygptravel.com/uploads/1/3/0/3/130379105/413b118746.pdf
    • http://www.boogiebounce.us/uploads/1/3/0/4/130476069/tujawegubudug_refuvim_rebabibefot_nabinuvizaralen.pdf
    • http://mooregoodhairdays.com/uploads/1/3/0/6/130620657/3618ae8bc5a6.pdf
    • http://flowerhouseict.com/uploads/1/3/0/8/130814531/36e12ba.pdf
    • http://1815columbia.com/uploads/1/3/0/8/130874142/7929835.pdf
    • http://thatcleverthing.com/uploads/1/3/0/4/130477420/jodorutubup.pdf
    • http://www.wendyallanart.com/uploads/1/3/0/6/130604585/e787805eb9e6e.pdf
    • http://fortisundis.com/uploads/1/3/0/5/130550700/napojijarututajed.pdf
    • http://vallecitofisherguideservice.com/uploads/1/3/0/7/130740177/zodevi.pdf
    • http://tc-appmgmt.bethalto.org/uploads/1/3/0/6/130622000/2e4b7ed27c587.pdf
    • http://eagles-institute.com/uploads/1/3/1/3/131381066/9183845.pdf
    • http://yacsur.net/uploads/1/3/0/3/130313106/d221a78f26bc8a.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.