Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfe4d52c19e6ce04…

MALICIOUS

PDF

41.0 KB Created: 2020-03-09 10:58:35 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: a45a43e63a28a233f3bc20e0bf59f460 SHA-1: 213476b0105f949b0b83d882fe6c123b8ce2aac6 SHA-256: bfe4d52c19e6ce04cfb78f3f81611d6a76c48154c9a71a4a7fee57c719aae31a
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are SEO-optimized and point to other PDF files. This indicates a link farm or SEO poisoning tactic designed to drive traffic to potentially malicious content. The document body, though partially corrupted, suggests a lure related to educational materials, further supporting a phishing or malicious download scheme.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://armstrong-family.rominastiebenphotography.com/uploads/1/3/0/6/130620467/130620467.html#oxford+grammar+for+schools+1+pdf+free+download
    • http://romelocaltourguides.com/uploads/1/3/0/7/130776366/wigetamezowatetasi.pdf
    • http://un-nyc.com/uploads/1/3/0/7/130738754/sidikasixuzo.pdf
    • http://banningdrags.com/uploads/1/3/0/7/130738550/mutubu_dukukuzogaboto_sekiguregifi_bonizeroni.pdf
    • http://getmedeal.com/uploads/1/3/0/5/130546742/bigawejexugut_melat.pdf
    • http://www.leannu.com/uploads/1/3/0/6/130621153/gaberefedime_xafusatefijoj.pdf
    • http://black-opps-nutrition.com/uploads/1/3/0/6/130605347/79d2d59be828.pdf
    • http://referidas.com/uploads/1/3/0/6/130604004/jedeburur-dakekilafelof-mibonuzerav.pdf
    • http://brownestonetravel.info/uploads/1/3/0/7/130775443/fifukifepizej_gexivupir_wexumi_benazudiwo.pdf
    • http://movingsquad.ca/uploads/1/3/0/6/130621148/duwukepunore-rovig-kiwowa-kilubexod.pdf
    • http://mta-sts.mail.a-punkt.ch/uploads/1/3/0/3/130323466/31f0b740c.pdf
    • http://www.moresue.com/uploads/1/3/0/7/130776386/rabofowakunitaf-zomasisabuguk-bugux.pdf
    • http://dan-lynch.com/uploads/1/3/0/2/130289729/e1ef810.pdf
    • http://remotepatiemtmonitoringinc.com/uploads/1/3/0/2/130289570/soreluraba_rurapisegu_gijixiji_rosibedevo.pdf
    • http://babaanddada.com/uploads/1/3/0/4/130435738/5961925.pdf
    • http://myshinglesstory.com/uploads/1/3/0/3/130379297/tediles_dazenisexupusod.pdf
    • http://moorebirthday.com/uploads/1/3/0/6/130604862/865954.pdf
    • http://jayexner.com/uploads/1/3/0/3/130323748/nixirotur_wokumibajusojum_fuwupixo_darum.pdf
    • http://mdcurbside.net/uploads/1/3/0/5/130541924/5d6b5d11e0d.pdf
    • http://mrbojandals.com/uploads/1/3/0/5/130544131/tusakaperinude-rusubilewowew.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000061f1.bin
ed747cee44c91912a5522577da3c891fa3eff5a4c9e2031c28814669f2f0ad6f
pdf-font-stream PDF embedded font (sfnt) at offset 0x61F1 7480 bytes
font_01_sfnt_off00007e82.bin
f0131ee56810017aecb1b1f1316fd22f0f93c9e21ddd00200b293d2fe9d9ac54
pdf-font-stream PDF embedded font (sfnt) at offset 0x7E82 16592 bytes