Malicious PDF — malware analysis report

Static analysis result for SHA-256 d1428225ef7c8bcc…

MALICIOUS

PDF

41.1 KB Created: 2020-03-08 00:17:21 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 846b86f58fee9985a580d7fb53f6f4c0 SHA-1: dfdfe4c72461296324b65eeeba2bcc09f7e98992 SHA-256: d1428225ef7c8bcc214519a80982499bfbec4a3f8cbfa4615dde8bb69afffd71
122 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell T1204.002 Malicious Link

The PDF document contains a lure for 'Internet banking online registration' and exhibits a link farm structure, suggesting it's part of a phishing campaign. The presence of multiple external PDF links points to a strategy of distributing malicious content across various domains. The document also includes heuristics indicating it's designed to harvest MFA codes or prompt callback phishing, further reinforcing its malicious intent.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hypnose-kinderwunsch.com/uploads/1/3/0/8/130813588/130813588.html#internet+banking+online+registration+union+bank+of+india
    • http://body-volume.com/uploads/1/3/0/6/130639581/xomuwur.pdf
    • http://larkappella.com/uploads/1/3/0/2/130291029/05265d7.pdf
    • http://www.committobetter.com/uploads/1/3/0/8/130874262/zevanidafilolek.pdf
    • http://rethreadclothingco.com/uploads/1/3/0/7/130739280/nisowaj-rovizoku-joxofumasiwib.pdf
    • http://northbridgepropertyrights.com/uploads/1/3/0/8/130814122/4235c590a6.pdf
    • http://theworldofboden.com/uploads/1/3/0/8/130815664/4328520.pdf
    • http://castvo.com/uploads/1/3/0/5/130544652/sugozasi.pdf
    • http://sweetdreamsdelight.org/uploads/1/3/0/6/130604147/ziguvoxebasu_dakuf_fizimitubivane.pdf
    • http://phobsies.ca/uploads/1/3/0/7/130740196/xodukemokaxex_fozep_fevina_tikadorix.pdf
    • http://ags-us.org/uploads/1/3/0/8/130874282/temepazabitoxu.pdf
    • http://kittycomfortpetsitting.com/uploads/1/3/0/5/130538986/2682603.pdf
    • http://www.aerialvisionservices.org/uploads/1/3/0/6/130603866/rajodiw.pdf
    • http://shinebrightsolarcleaning.com/uploads/1/3/0/5/130550764/gisenirevirose-fibazulijabi-dowadokatig.pdf
    • http://mail.thelambranch.com/uploads/1/3/0/7/130738646/3051353.pdf
    • http://vincesfamous.com/uploads/1/3/0/7/130775164/vevuborigowu_fefuwe_nipanunetok.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000774e.bin
982e5be87fb567fcfee47565688f3889272713c38e1a1b34550ed3c5473ca6b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x774E 8124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.