Malicious PDF — malware analysis report

Static analysis result for SHA-256 da8ea1e54fbd8200…

MALICIOUS

PDF

46.1 KB Created: 2020-03-13 02:02:22 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e60b3b6dd93f43958e7adec20320c91a SHA-1: a71866afdb34fb4fdb9d4010e9107f2eea6b75a6 SHA-256: da8ea1e54fbd8200ca5c67d6268ea2737283c6aef21240b90388cd90554c0325
112 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document contains a large number of external links, many of which point to other PDF files, suggesting a link farm designed to improve search engine rankings or distribute malicious content. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document likely instructs the user to open a password-protected archive, a common tactic to bypass gateway security. The presence of a visual download button further supports a malicious workflow. No scripts were extracted from this sample.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sciadventures.com/uploads/1/3/0/6/130604666/130604666.html#learn+english+conversation+audio+free+download
    • http://onestoneworks.com/uploads/1/3/0/5/130545681/29d33e5267.pdf
    • http://pete-jeannette.com/uploads/1/3/0/3/130313070/ravidijajimaf-redejel.pdf
    • http://hostmaster.scottishpigs.coop/uploads/1/3/0/6/130604427/9384974.pdf
    • http://milemeter.net/uploads/1/3/0/6/130639590/953e9f.pdf
    • http://woodenbathtubs.co.nz/uploads/1/3/0/7/130775672/menedodipisamu_fafitujutiwob.pdf
    • http://www.nelnahbessiejohn.com/uploads/1/3/0/4/130488412/9168588.pdf
    • http://anaissilva.com/uploads/1/3/0/8/130874504/tixatusu.pdf
    • http://ultimateservicesgroup.co.uk/uploads/1/3/0/7/130739755/xemagomol_borovubotaxuz.pdf
    • http://kitchencocktails.net/uploads/1/3/0/6/130603941/3198751.pdf
    • http://www.thesocialkey.es/uploads/1/3/0/3/130313500/2075177.pdf
    • http://www.cadaconsulting.com/uploads/1/3/1/0/131069898/tomudaworudolo.pdf
    • http://soulstoked.com/uploads/1/3/0/4/130489152/guwadi_rarudo_fodaperigi.pdf
    • http://angelsofhopecenter.com/uploads/1/3/0/6/130604911/zipedepuru-wukezemikin-gijabes-kenaj.pdf
    • http://theflyingv.org/uploads/1/3/0/7/130740550/9241628.pdf
    • http://mx.reghanross.com/uploads/1/3/0/4/130488544/gizunalufub.pdf
    • http://spiritquestshop.com/uploads/1/3/0/9/130969494/lixepebi.pdf
    • http://www.ahsni.com/uploads/1/3/0/7/130775166/8559542.pdf
    • http://neplus.co/uploads/1/3/0/8/130874455/9157286.pdf
    • http://cubcreekheating.com/uploads/1/3/0/7/130775622/a1ce8e3f77b.pdf
    • http://bsgfinancial.com/uploads/1/3/0/6/130639443/249fd842c3512.pdf
    • http://xtwdn6.brdge.org/uploads/1/3/0/6/130620473/pafaxis-tebezofawusufib-selozedaroder.pdf
    • http://berkeywaterfiltersource.com/uploads/1/3/0/7/130775950/6e047be4.pdf
    • http://islandclubreccenter.com/uploads/1/3/0/7/130738666/dapoxixonolovuvo.pdf
    • http://arthvrian.net/uploads/1/3/0/3/130313619/pixesokobafoni_polulof_xakije_ziwuboledogup.pdf
    • http://www.blogpawsandpamper.com/uploads/1/3/0/6/130621950/23efd73.pdf
    • http://arthvrian.net/upload
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000081b0.bin
b2379758dd4fdab61715eb75f987a918e98eb0ce37cfea8747845d802ad28275		 pdf-font-stream PDF embedded font (sfnt) at offset 0x81B0 8096 bytes
font_01_sfnt_off0000a0eb.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA0EB 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.