Malicious PDF — malware analysis report

Static analysis result for SHA-256 e43f3a94d9030635…

MALICIOUS

PDF

66.1 KB Created: 2020-04-12 01:57:38 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: e7176debd5b69b360c32e9da14dbccf3 SHA-1: 3924a18be78f0a85efe948b671310b7be972e30d SHA-256: e43f3a94d9030635ce54186e5aab68f9d067d7a089f147f6f68d1993e8a98076
84 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to similarly structured URLs, suggesting a link farm for SEO poisoning or phishing. The document body also contains a lure related to connecting a Sony MDR RF985R to a phone, and a heuristic indicates a callback phishing phone lure. The presence of numerous unknown-reputation URLs suggests a malicious intent to redirect users to potentially harmful content or phishing sites.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kyflowernseed.com/uploads/1/3/1/3/131381481/131381481.html#sony+mdr+rf985r+connect+to+phone
    • http://elkhartcottagecarecrystalcottagecare.com/uploads/1/3/0/5/130551015/f8858389c.pdf
    • http://denisekamm.com/uploads/1/3/1/4/131409717/fa21e35bc183c7.pdf
    • http://gailfranklin.com/uploads/1/3/0/4/130435561/wuvatex_sewoxijanujiwim_wojuxilo.pdf
    • http://thenaturallearner.com/uploads/1/3/1/3/131383777/tubinagopuz.pdf
    • http://dallasairductcleaning.net/uploads/1/3/1/3/131384260/1444684.pdf
    • http://vladtheinventor.org/uploads/1/3/0/7/130740385/a4ec29fe9d350.pdf
    • http://partnersinrelief.com/uploads/1/3/1/0/131070137/53f1fe3.pdf
    • http://prosseracupuncture.com/uploads/1/3/0/5/130588865/maviwavurududeko.pdf
    • http://saltandjuniper.com/uploads/1/3/0/9/130969937/fivubope-lusilobokowipi-jalavukapasozus-pidulavuta.pdf
    • http://spacetimecafesartesanais.com/uploads/1/3/0/2/130291779/d926455824.pdf
    • http://amballoonexpress.com/uploads/1/3/1/4/131437283/dcc2b.pdf
    • http://gweniveremoon.com/uploads/1/3/0/6/130620542/rorebo.pdf
    • http://journeysofalifetime.net/uploads/1/3/1/4/131407507/dogakafas_dabijodigixu_jisupinif.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a5de.bin
98258d3081075b93b64333b6eed8e9b858583903e328f540f520a233ed9c726e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA5DE 8704 bytes
font_01_sfnt_off0000c748.bin
00af05c2609f01c33c23ab26654f9d59263ebd0c8d1e5c6d3c0748785099e532		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC748 1348 bytes
font_02_sfnt_off0000ceb5.bin
7f80e44d37c1f6c2195f21af695f3caafe2445507039e32b5c6c8af5b231b2e8		 pdf-font-stream PDF embedded font (sfnt) at offset 0xCEB5 8264 bytes
font_03_sfnt_off0000e5f9.bin
1bd060ba27fbc97b54c3f7cf393427bfd8be30f704aaa9c2c6c69737e69f0ed0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE5F9 10552 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.