Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4cb1ef796122576…

MALICIOUS

PDF

42.2 KB Created: 2020-03-16 02:51:08 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5e2e8eda62c67e2f5a618610e5d7f6d9 SHA-1: e8fe9df6ecdb2078cec43d6f0441b13c65a12899 SHA-256: e4cb1ef7961225761a724f16112c8f017fa586661dc1e7ea644bca7738ff0b77
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, many pointing to PDF files hosted on various domains, suggesting a link farm for SEO manipulation or to distribute malicious content. The primary URL, http://5pointauto.com/uploads/1/3/0/6/130604477/130604477.html#fujitsu+scansnap+s1500+user+guide, is likely the initial landing page for the attack.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 42 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://5pointauto.com/uploads/1/3/0/6/130604477/130604477.html#fujitsu+scansnap+s1500+user+guide
    • http://seoboards.com/uploads/1/3/0/4/130488387/lutedowelo-derimelameta-mezatudiganiju-netikosuda.pdf
    • http://livingwaterupc.org/uploads/1/3/0/4/130435694/jilufenofozo.pdf
    • http://newtonanchorbar.co.uk/uploads/1/3/0/7/130775365/9260165.pdf
    • http://rncheadquarters.com/uploads/1/3/0/6/130620268/wujisopijivamofipe.pdf
    • http://hustleandheartbeauty.com/uploads/1/3/0/2/130289623/gujeladefuxako_mogutopavik_jiluxasewesotok.pdf
    • http://theperseverancedietbook.com/uploads/1/3/0/7/130739449/selemomu-gesirisijowade-gelegabek.pdf
    • http://locimedia.com/uploads/1/3/0/4/130436050/vomekuxevi_potumidaleb.pdf
    • http://entertainmentaccelerator.com/uploads/1/3/0/8/130873906/9818432.pdf
    • http://guided-events.com/uploads/1/3/0/4/130476342/cbf4c.pdf
    • http://www.riverinbetween.com/uploads/1/3/0/6/130640159/a12489e25d9e4.pdf
    • http://mountainbikegreenville.com/uploads/1/3/0/6/130620885/fajokuwo_gisolu_detexam_ziwuxa.pdf
    • http://iqfee.net/uploads/1/3/0/6/130604812/b3f12a3acd3f9.pdf
    • http://discovergreencleaning.com/uploads/1/3/0/8/130814462/c7ec9.pdf
    • http://www.olivettebythesea.com/uploads/1/3/1/0/131070982/jawutajoxivema.pdf
    • http://lambertfarmslogisticspark.com/uploads/1/3/0/2/130272804/9038738.pdf
    • http://laccdsustsainability.com/uploads/1/3/0/7/130774993/votonosil.pdf
    • http://sethspartanempire.com/uploads/1/3/0/4/130483396/6254687.pdf
    • http://beautifulpinkk.com/uploads/1/3/0/8/130813899/c6c1d3ae.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000085b0.bin
205e2467ce231f7c23b93ddfd2a1cac32f41d248513797d03663592ef33be605		 pdf-font-stream PDF embedded font (sfnt) at offset 0x85B0 5276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.