Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7218ae7efa0f9cd…

MALICIOUS

PDF

55.8 KB Created: 2020-04-18 20:17:45 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5786735902e0a5119482e9a274a3a1a6 SHA-1: 41a85557c677eb462344669ee89c2073b69aa898 SHA-256: b7218ae7efa0f9cd867b3e022fe06e0643d068b88323926b3222994b8088b523
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a mass external link farm, with many URLs pointing to PDF files. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' indicates the document's content is designed to trick users with promises of money or prizes, a common tactic in advance-fee fraud. The embedded URL 'http://mychoicemedicalpractice.com/uploads/1/3/1/3/131398094/131398094.html#budget+2019+highlights+pdf+gradeup' likely serves as the initial lure for this scam.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mychoicemedicalpractice.com/uploads/1/3/1/3/131398094/131398094.html#budget+2019+highlights+pdf+gradeup
    • http://tryonautocare.com/uploads/1/3/0/4/130483487/7838256.pdf
    • http://pensacolasup.com/uploads/1/3/0/6/130639183/nolanovuwifiked-nufomej.pdf
    • http://matthewsdodrill.com/uploads/1/3/1/3/131383594/8e9eb328a7b836f.pdf
    • http://thesongstress.net/uploads/1/3/0/6/130639513/c08bb6f774d7.pdf
    • http://yubeautylounge.com/uploads/1/3/1/3/131398360/2ed3a3587dad57.pdf
    • http://glbsystems.com/uploads/1/3/0/2/130291908/wexezalov-suvotop.pdf
    • http://spencerpierrard.com/uploads/1/3/0/4/130483963/2282543.pdf
    • http://thebadart.com/uploads/1/3/1/4/131483090/sobov.pdf
    • http://sainteanne-hornaing.fr/uploads/1/3/1/1/131163601/d257e37981c.pdf
    • http://domusservice.org/uploads/1/3/0/5/130543476/tadifek.pdf
    • http://lcosmetics.net/uploads/1/3/1/4/131406835/e38ded4a1218.pdf
    • http://littlefootprintsdaycarellc.com/uploads/1/3/0/4/130489262/pudezewozen_sixovirumo.pdf
    • http://pennyraeart.com/uploads/1/3/1/4/131407227/gekesikuba.pdf
    • http://gordonrealestateadvisors.com/uploads/1/3/0/4/130483273/3748590.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000b2b0.bin
a8e4943e5e7bbfdc0001bfc87f1eaeb9bfe32d743ee3de32b71195e9e60cdffb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB2B0 8476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.