Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4daac70db7211ac…

MALICIOUS

PDF

42.2 KB Created: 2020-04-15 07:54:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 21b9b6800ee52c2378cfa5208fc32cd9 SHA-1: 04e54669bad809ee4b127675ffbc24a5a3c90193 SHA-256: e4daac70db7211ac07a65682f4466dda0ea6437d874b322528437bc28f9e8a9c
104 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1204.002 Malicious File

The PDF contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. The presence of a SE_LOLBIN_RUN_COMMAND heuristic indicates that the document contains instructions for executing Windows scripting tools. The document body itself is heavily obfuscated but contains URLs that are also listed in the heuristics, reinforcing the link farm hypothesis. The primary intent appears to be directing users to a network of websites.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://teleformav.org/uploads/1/3/1/3/131384298/131384298.html#bachianas+brasileiras+no+5+partitura+pdf
    • http://mintconstruction.org/uploads/1/3/1/3/131398576/xekitojigedevit.pdf
    • http://writeproject.org/uploads/1/3/1/4/131483465/jedovizugesejapuzab.pdf
    • http://jennifersharpe.com/uploads/1/3/1/4/131437504/7087097.pdf
    • http://avprestigio.com/uploads/1/3/0/5/130544090/mojekogazuwonu.pdf
    • http://paris-lyon-japon.com/uploads/1/3/0/7/130739616/82e2177772.pdf
    • http://grandsmarketinggroup.com/uploads/1/3/1/6/131606373/9184911.pdf
    • http://karinamadrigal.com/uploads/1/3/0/5/130589267/5610229.pdf
    • http://stewartcustomdesign.com/uploads/1/3/1/3/131378852/310f55795c.pdf
    • http://babae.store/uploads/1/3/0/5/130551694/dakunexineno.pdf
    • http://methodpotentialhmc.com/uploads/1/3/0/7/130775352/064426db5c60dd.pdf
    • http://uritheintuitive.com/uploads/1/3/0/6/130603785/revozozejeme-jewujaboz.pdf
    • http://saskiarooijakkers.com/uploads/1/3/0/7/130738562/tukitozo-katumuze-tozezurozu-xikopopalubu.pdf
    • http://gupoficesa.com/uploads/1/3/1/1/131164248/jikifitavobebamuban.pdf
    • http://iamoldhead.com/uploads/1/3/0/4/130478067/gawibup.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000079c6.bin
2c030629dcd7f28682270b31d0a1a4ebc7295663b750a18a4c84ff1fd07c7a86		 pdf-font-stream PDF embedded font (sfnt) at offset 0x79C6 9480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.