Malicious PDF — malware analysis report

Static analysis result for SHA-256 dcf468a947257ab3…

MALICIOUS

PDF

44.7 KB Created: 2020-03-15 01:01:00 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: bb1e7c33d591772e3e144dfb8c5ab7f4 SHA-1: 6190d765e571f7e7b837793906317d3d70ccf05b SHA-256: dcf468a947257ab3dff68c734066149fa6050c28ba070baba261ba7f1676e395
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, many pointing to other PDF files, indicative of a link farm or SEO poisoning attack. The document body also contains a direct URL, 'http://74-123-78-173.mgwnet.com/uploads/1/3/0/3/130324206/130324206.html#bejeweled+3++free+full+version+pc', which likely serves as a lure. The 'SE_CLICKFIX' heuristic suggests the document may also attempt to trick users into executing commands directly, bypassing macro restrictions.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-78-173.mgwnet.com/uploads/1/3/0/3/130324206/130324206.html#bejeweled+3++free+full+version+pc
    • http://lustbynisha.com/uploads/1/3/0/9/130969614/gawewubelekebovepedo.pdf
    • http://varush.org/uploads/1/3/0/2/130289171/3b50198497a.pdf
    • http://silveroceangroup.com/uploads/1/3/0/5/130551112/zipixawoku-xevozuvomijus-zelopus-vafulomudufid.pdf
    • http://beatrixhelenaevents.com/uploads/1/3/0/7/130775017/2842921.pdf
    • http://mta-sts.mail.giulianoseda.ch/uploads/1/3/0/4/130476795/kojuvomalurof-jivodikev-ginefelon.pdf
    • http://giftoffullness.com/uploads/1/3/0/3/130379718/wutiga_barorinobuvazak_baliwamop.pdf
    • http://scentamor.com/uploads/1/3/0/6/130640074/wugolawanedidabidud.pdf
    • http://kayla-rose-artist.com/uploads/1/3/0/2/130288364/6e4e0a3d044bb.pdf
    • http://radikal4kidzinc.org/uploads/1/3/0/8/130874470/pawekujoxo-govef-zamir-gubokivazamo.pdf
    • http://breastenhancementcenterofthewoodlands.com/uploads/1/3/0/4/130476192/9094242.pdf
    • http://ulessor.com/uploads/1/3/0/8/130813922/972f7219d7a.pdf
    • http://slabmade.co.uk/uploads/1/3/0/6/130621533/xalito.pdf
    • http://necklaceswithsharon.com/uploads/1/3/0/6/130620662/4340190.pdf
    • http://myanalogworld.com/uploads/1/3/0/7/130739452/0a9fa6779.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000086c7.bin
c30e0106335f9f96a3f792f50ae17c281a5cd9a7c7781b69b32111f4dfd84ea2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x86C7 7936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.