Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd61ed50962e45c1…

MALICIOUS

PDF

43.5 KB Created: 2020-05-17 06:31:25 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: e9806ac64e8bf719e736fc4e9d0cb056 SHA-1: b9ec24dacf2aa50f8e8c41e1354a451074bbf782 SHA-256: bd61ed50962e45c14efa99f03bcf6e8c6881bfd04b6affdd8a7a804065f64d7e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, many of which are dynamically generated and point to unrelated domains, indicating a link farm or SEO poisoning tactic. The document body references 'Plague Inc. neurax worm' and includes a call-to-action phrase, suggesting a lure to download malicious content disguised as a guide. The primary IOCs are the numerous external URLs embedded within the document.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danaligt.com/uploads/1/3/0/3/130313153/130313153.html#plague+inc+neurax+worm+mega+brutal+guide
    • http://goldcrestvaleting.com/uploads/1/3/1/6/131607239/cf58a73.pdf
    • http://andersonfitnesssurrey.com/uploads/1/3/0/2/130291561/jugiluridelafe_rivubefisep_wipotolu_mukivezuw.pdf
    • http://beaverpatriot.com/uploads/1/3/0/8/130874347/4588529.pdf
    • http://sistahspacemidwifery.com/uploads/1/3/0/6/130639767/wuvesi-repefo-rusumisuxazesaj-letibedi.pdf
    • http://3oceanfive.com/uploads/1/3/1/4/131412858/xubiwutuvivux.pdf
    • http://coreap2004.com/uploads/1/3/0/2/130289587/faxevap.pdf
    • http://safetravels247.com/uploads/1/3/1/4/131454222/tufuxesobupelivopig.pdf
    • http://titaot.com/uploads/1/3/0/5/130547613/2179902.pdf
    • http://centreoftheearth.org/uploads/1/3/0/5/130540700/vigolowetot_gelatenewu.pdf
    • http://thewellchurchsd.com/uploads/1/3/0/7/130775471/susutafo.pdf
    • http://reikidistancehealer.com/uploads/1/3/0/7/130775521/7272970.pdf
    • http://sacazeandpartners.com/uploads/1/3/1/4/131453267/f0f9d9e57f69e2.pdf
    • http://arteducatorsofiowa.org/uploads/1/3/0/3/130323293/acd3c23c40.pdf
    • http://henhaul.com/uploads/1/3/0/6/130620792/8420772.pdf
    • http://thomanimation.ch/uploads/1/3/0/8/130813975/fogatonejemaw_rokasavabero_javusasiro_welinizuvud.pdf
    • http://lenisewilliams.net/uploads/1/3/0/7/130739443/db190aa9490.pdf
    • http://donotforgetme.org/uploads/1/3/0/6/130640182/babigifosajixabawo.pdf
    • http://peacefulvibehealing.com/uploads/1/3/0/7/130738714/5856005.pdf
    • http://redbarnmontessori.com/uploads/1/3/0/7/130776206/mapaposojabuwir-ripiwodenuno-lominotenojika-rowelunafew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007cb4.bin
9c8b771921c158326878c11cfb95bad9edeec436357f3d4b18d93b9df48bcb1c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CB4 11032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.