Malicious PDF — malware analysis report

Static analysis result for SHA-256 d5d15d6ecbc14507…

MALICIOUS

PDF

39.0 KB Created: 2020-03-24 16:12:21 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: b71eeb8936f7a334cb27536d74a0a203 SHA-1: f4e05410b55c259124a26e5b3cc351122e954796 SHA-256: d5d15d6ecbc145079c6a105b3fdbf9ad184a1177c796af4ee506bbc3531fedef
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains numerous external links, a common tactic for SEO link farms and distributing malicious content. The document body text, though partially corrupted, suggests a lure for a 'sheet music app', combined with a call-to-action phrase. The heuristic firings confirm the presence of a mass external PDF link farm, indicating a likely attempt to redirect users to malicious sites or download further payloads.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neokundalini.org/uploads/1/3/0/7/130740349/130740349.html#sheet+music+app+android+free
    • http://naturesbeautysc.com/uploads/1/3/0/4/130488295/5631073.pdf
    • http://caffelina.com/uploads/1/3/0/6/130604509/nofevu_likutuwigi_wivowek_xibiv.pdf
    • http://faithandchristianaccessories.com/uploads/1/3/0/3/130379445/158ae3f5d825b.pdf
    • http://ministryops.net/uploads/1/3/0/5/130539350/javela.pdf
    • http://josestad.nl/uploads/1/3/0/7/130738635/sebozujusugojob.pdf
    • http://almostkindalucky.com/uploads/1/3/0/5/130551775/9b3b547.pdf
    • http://ronswalktalks.com/uploads/1/3/0/5/130551202/8456717.pdf
    • http://majiangdouniuguize.br3h.com/uploads/1/3/0/6/130622063/tifal.pdf
    • http://educazionelibertaria.com/uploads/1/3/0/4/130435594/tutimililimiwiviva.pdf
    • http://myeskimokisses.com/uploads/1/3/0/4/130489082/genozijegagidogilas.pdf
    • http://humphreyscountyculturalmuseum.org/uploads/1/3/0/7/130738720/792403.pdf
    • http://mydmdesign.com/uploads/1/3/0/6/130621596/jeseresus_furakasema_wenatokatiz.pdf
    • http://cpanel.davidselen.be/uploads/1/3/0/7/130776889/89c0ccd.pdf
    • http://mypecans.com/uploads/1/3/0/7/130775164/3285074.pdf
    • http://goldstarcruisesandtravel.com/uploads/1/3/0/2/130291884/3657481.pdf
    • http://www.everytoneforum.com/uploads/1/3/0/3/130313145/a7b9c4d7.pdf
    • http://tampapersonalchef.com/uploads/1/3/0/8/130874429/xuxube.pdf
    • http://madpalace.com/uploads/1/3/0/5/130545537/d6e985a8eb.pdf
    • http://riosautodesigns.com/uploads/1/3/0/4/130489898/kelagapesa.pdf
    • http://historysstoryteller.com/uploads/1/3/0/9/130969199/84cee64b4a2a49f.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000713c.bin
8c68f20e5a4ee5a9bbd1d94919039c846fb8f31f155cfb9ae6e8b702e90561b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x713C 7512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.