Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf3e6852645398b8…

MALICIOUS

PDF

37.5 KB Created: 2020-04-21 21:20:41 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 134a3779bc4aff4eb0528fd10b70c087 SHA-1: 78ae2dd0518c6206c739aa940008adf645cf5564 SHA-256: bf3e6852645398b8a55c6d36db42ccc100927be16a287f49b460ce8ab6218628
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a lure related to a 'barcode generator free pc' and embeds a large farm of external PDF links. This suggests a social engineering attack aimed at directing users to a collection of potentially malicious or spam-filled websites. The primary mechanism appears to be a link farm designed to inflate search engine rankings or distribute unwanted content, rather than direct payload delivery.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thegatesmillsgardenclub.org/uploads/1/3/0/6/130621158/130621158.html#barcode+generator+free++pc
    • http://teamhighaltitude.com/uploads/1/3/1/0/131070452/5775832.pdf
    • http://bramblebooks.org/uploads/1/3/1/3/131379225/d52720e347.pdf
    • http://clickfourhelp.com/uploads/1/3/0/3/130323255/bevixujevu.pdf
    • http://jesse-ault.com/uploads/1/3/1/3/131381518/ec638.pdf
    • http://elkephilips.com/uploads/1/3/1/3/131398345/galipawexip-rigawikimomovuj.pdf
    • http://northernanaes.com/uploads/1/3/0/4/130476075/zususugujezok.pdf
    • http://newtours.org/uploads/1/3/0/5/130588169/wifeted-sosokovizake.pdf
    • http://salateenrestaurant.com/uploads/1/3/0/5/130550867/nitolow-xozetenuf.pdf
    • http://seekhomehealing.com/uploads/1/3/0/5/130551011/vivazuvunepuku.pdf
    • http://robbinsroostrealestate.com/uploads/1/3/0/4/130435573/tutepop_fuzufatetenuxok_guvekebon.pdf
    • http://thefityou.com/uploads/1/3/0/6/130604250/6874176.pdf
    • http://siberiancatsco.com/uploads/1/3/0/6/130605420/92d1dd24.pdf
    • http://vilovely.com/uploads/1/3/0/7/130776338/guvurided.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006917.bin
b42cff84ab46514e4e13b542d112694b2793a25b17fbd684292ff38860eb761d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6917 8676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.