Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf2b5e9e1a6ab39f…

MALICIOUS

PDF

45.5 KB Created: 2020-04-17 23:25:00 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6e77c713c1d08d28d6babb42248c026d SHA-1: 123e2770b29cc7fc71d416f3117a8d9261d4e8ee SHA-256: bf2b5e9e1a6ab39f5f39740e1a6a8723254c7059d510b7b41856d991d2e817a8
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.001 User Execution: Malicious Link

The PDF contains a mass of external links, many pointing to other PDF files, suggesting a link farm for SEO or to distribute malicious content. The document body, though heavily obfuscated, contains text related to a scholarship application and a URL that also mentions scholarship applications. The 'SE_CALLBACK_LURE' heuristic indicates the document likely prompts the user to call a phone number, consistent with callback phishing or tech support scams. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://findingmysparkle.org/uploads/1/3/0/8/130873738/130873738.html#vidyasiri+scholarship+2019+application+form+for+minority
    • http://gerryvandenken.com/uploads/1/3/1/6/131606954/68658fe.pdf
    • http://1663turk.com/uploads/1/3/0/7/130775520/3e7e78bbc5bbf0f.pdf
    • http://lonestarrainwater.com/uploads/1/3/0/8/130874299/buzalujuroxiva.pdf
    • http://tanjoy.net/uploads/1/3/0/4/130435624/rejonivewugoxel-latisufufew-wexaf-vepalawimor.pdf
    • http://attorneybrandonball.com/uploads/1/3/0/5/130588957/xolesoxazega_pudutinu_wasezabuzudare.pdf
    • http://jonnysdesignercloset.com/uploads/1/3/1/3/131398177/c942c64693a.pdf
    • http://marcosleonsmith.com/uploads/1/3/1/4/131438443/c85cc.pdf
    • http://fucd.rocks/uploads/1/3/0/7/130775952/godiluwon.pdf
    • http://itsapartycleveland.com/uploads/1/3/0/5/130547069/5ad320aba4a6372.pdf
    • http://jeromeiwrightassociatesinc.com/uploads/1/3/0/7/130739614/4618a644.pdf
    • http://jamiedevries.com/uploads/1/3/0/8/130813548/4985176.pdf
    • http://arthurcountywolves.org/uploads/1/3/1/3/131383998/2763742.pdf
    • http://gotchacomics.com/uploads/1/3/0/7/130775328/4330815.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00008a57.bin
34d1cd1c4eb4ceb4edef3b0bf9569c45fe94e3f1e344054cb1700850c960cfb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A57 8044 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.