Malicious PDF — malware analysis report

Static analysis result for SHA-256 d259f3b1f58c9523…

MALICIOUS

PDF

36.7 KB Created: 2020-03-07 15:28:50 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e23dd991b6d18bd03ce5e190102583d8 SHA-1: 20727361701c784cdb11bca568421512f3911e98 SHA-256: d259f3b1f58c9523b4a7c9bd243cff56e9a3dbe3c3e822ec9aed46a3c9768862
164 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious Link

The PDF contains an embedded script and multiple external links, indicating a likely attempt to redirect the user to malicious content. The presence of 'transfer fsmo roles powershell' in the document body and the 'SE_LOLBIN_RUN_COMMAND' heuristic suggest the script may involve PowerShell commands for execution. The embedded script payload and the numerous SEO-linked PDFs point towards a campaign distributing further malicious documents or payloads.

Heuristics 6

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded script payload in PDF stream high PDF_EMBEDDED_SCRIPT_PAYLOAD
    PDF stream bytes contain script execution markers such as ActiveXObject/CreateObject, WScript.Shell, PowerShell, or shell-exec primitives. This is stronger than ordinary PDF JavaScript because it indicates a staged external script payload hidden in stream bytes.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Suspicious extracted artifact medium EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.findfitnessnj.com/uploads/1/3/0/5/130543170/130543170.html#transfer+fsmo+roles+powershell
    • http://thesplendidwashrooms.co.uk/uploads/1/3/0/5/130551611/kujumoduzi_jolumijujemu_fejimutaxitit.pdf
    • http://sandwichislandsnetwork.org/uploads/1/3/0/4/130488743/7398405.pdf
    • http://networkmarketingmexico.com/uploads/1/3/0/7/130738543/4848274.pdf
    • http://lifewithoutbooze.com/uploads/1/3/0/5/130540585/132855.pdf
    • http://www.aplusgeneralconstructionllc.com/uploads/1/3/0/6/130621675/374216.pdf
    • http://mahafarhoud.com/uploads/1/3/0/7/130739404/4a32f3779.pdf
    • http://coloradoadaptivemartialarts.shop/uploads/1/3/0/2/130289344/gomanojivazumunuxow.pdf
    • http://handychevreuil.com/uploads/1/3/0/5/130543261/wewananija.pdf
    • http://coasttocoastroofs.com/uploads/1/3/0/4/130483288/moginitenipedep.pdf
    • http://lebarconstruction.com/uploads/1/3/0/5/130539373/mowone.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
embedded_pdf_script_00008ccf.bin
cd032f74184be502eea611514cdd77f7adb9393525bd6faee2b5331cb7450a8a		 pdf-embedded-script PDF raw stream script payload at offset 0x8CCF 1787 bytes
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 3 shell/COM execution token(s).
font_00_sfnt_off0000663b.bin
b731aaea6e225ccebb2e2dd6a9d3d449134ed88bf42bbbe9003dbc072b7d46c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x663B 7808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.