Malicious PDF — malware analysis report

Static analysis result for SHA-256 d85a1c786ebb3f0e…

MALICIOUS

PDF

36.4 KB Created: 2020-05-14 10:40:40 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e14e79abf52dbd6d1a89b8feb53f5cb1 SHA-1: 296e217244ccc0b5f449d5fa1eed221966e22b75 SHA-256: d85a1c786ebb3f0e0a4ce2f205957c7c7fa0f9a1665c8b78795175ef1312a0b2
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified as a link farm, and exhibits characteristics of an advance-fee scam lure. The embedded URLs likely lead to malicious content or phishing pages. The document's structure and content strongly suggest a social engineering attempt to deceive the user into clicking these links.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cugnette.fr/uploads/1/3/0/7/130739601/130739601.html#agency+problem+solutions+pdf
    • http://tesoroshaven.com/uploads/1/3/0/6/130639273/6307202.pdf
    • http://relaysecurity.com/uploads/1/3/0/4/130483236/1c596e8a5c1c727.pdf
    • http://quietpoppy.com/uploads/1/3/0/5/130538981/turagedi_negosov_sazubizaxode.pdf
    • http://victoriagudgeon.com/uploads/1/3/0/8/130873840/6011030.pdf
    • http://divinegrace101.com/uploads/1/3/1/3/131383204/kabubower.pdf
    • http://blkaceau.com/uploads/1/3/1/3/131383264/xekixeli.pdf
    • http://fghpartners.com/uploads/1/3/0/8/130814177/doziriwibexoxug-vikodosutuja-jusafaravarof-tanaxam.pdf
    • http://promaa.org/uploads/1/3/0/4/130477028/5972256.pdf
    • http://solucionesksm.com/uploads/1/3/0/7/130739656/7104428.pdf
    • http://rfwhilephotos.com/uploads/1/3/0/8/130814195/gizugemiteg.pdf
    • http://epsweetcorn.com/uploads/1/3/0/2/130272504/zerubajaja.pdf
    • http://jjandsonscustompress.com/uploads/1/3/0/4/130436289/rixexujamugiwib.pdf
    • http://uniqueplumbing.net/uploads/1/3/1/3/131397938/8245776.pdf
    • http://jenniferbachaphotography.com/uploads/1/3/0/6/130620176/508bacf.pdf
    • http://bluebunnycarrots.com/uploads/1/3/1/0/131070279/fesilasidenut_juzoxow_xoxujo_mosegesunopi.pdf
    • http://starstrings.com/uploads/1/3/1/4/131406387/lepubewavet.pdf
    • http://mymajestycollection.com/uploads/1/3/0/2/130289670/a155592.pdf
    • http://alevelsciencesupport.com/uploads/1/3/0/8/130873961/9444629.pdf
    • http://chopsticksmine.com/uploads/1/3/0/7/130775545/a366d0345c55bf.pdf
    • http://wisdomsportswear.com/uploads/1/3/0/8/130874458/filokamog.pdf
    • http://emdrandtrauma.com/uploads/1/3/0/6/130620356/034ac8df.pdf
    • http://singtomair.com/uploads/1/3/1/6/131607407/revoxupuxun.pdf
    • http://ipv6.baas-finance.nl/uploads/1/3/0/7/130775653/111de661d00c.pdf
    • http://ijalepublishing.com/uploads/1/3/0/9/130969390/ledal_jutaxigifog_daduzurabul.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000657a.bin
f1fb1ec97f541ece8689cb8438bc0772da0cf4ef5d2768fd56d5adc675fa9e82		 pdf-font-stream PDF embedded font (sfnt) at offset 0x657A 9296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.