Malicious PDF — malware analysis report

Static analysis result for SHA-256 e4e0aeb8499d2b51…

MALICIOUS

PDF

27.6 KB Created: 2020-03-25 02:49:31 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 6a2e3180a5472fafd7385144ffbaa7a3 SHA-1: b71172173ab131d7141c6d947559210b48c65821 SHA-256: e4e0aeb8499d2b51ffe3409c88ac4891553d5db89cfb9b9e40581030ea00780f
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains a single image and a click-outward action pointing to a remote HTML resource. The document body, though heavily obfuscated, contains multiple URLs that appear to be part of a link farm, suggesting a broad distribution effort. The primary attack pattern involves tricking the user into clicking a link that leads to a malicious destination.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 27 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://retakedemocracy.com/uploads/1/3/1/0/131070491/131070491.html#finger+pick+guitar+players
    • http://poulsborvkent.com/uploads/1/3/0/9/130969876/vikegose_doxufarotami_telemixixo_fowaviwafam.pdf
    • http://prettypersonalities.com/uploads/1/3/0/7/130738696/4703869.pdf
    • http://atsbo.com/uploads/1/3/0/6/130639393/vurebix-wepububota.pdf
    • http://www.peaceofmindkindercare.com/uploads/1/3/1/0/131069750/dosadipabisalet.pdf
    • http://frankbardessono.com/uploads/1/3/0/5/130588595/xugumajuwobo-detebowa-koborawarupado.pdf
    • http://wssdcsa.com/uploads/1/3/0/9/130969633/259fe53dc4.pdf
    • http://webdisk.mciea.org/uploads/1/3/0/7/130775166/2765619.pdf
    • http://revirg.com/uploads/1/3/0/7/130775197/vasofazewom-giwoladekag-bededidufa-toxelekoga.pdf
    • http://cuttingedgesebringfl.com/uploads/1/3/0/7/130738803/65e29fe3eb940.pdf
    • http://oasisfurniture.net/uploads/1/3/0/8/130814101/nuligibofafamefunuk.pdf
    • http://arandonovan.com/uploads/1/3/0/4/130476572/fufelopagewi.pdf
    • http://britontheroad.com/uploads/1/3/0/3/130313271/9183571.pdf
    • http://www.lexieflick.com/uploads/1/3/0/5/130539131/retulefuwusa.pdf
    • http://thehustlernetwork.com/uploads/1/3/0/5/130589420/1589910fce6c0c.pdf
    • http://andres-historical.com/uploads/1/3/0/6/130620228/5465072.pdf
    • http://listislanddesign.com/uploads/1/3/0/5/130588512/47f3fe9843a.pdf
    • http://mireillemanzone.com/uploads/1/3/0/6/130639530/sinurenifupa-vujufadile.pdf
    • http://davidjiang.us/uploads/1/3/0/7/130775388/8cc4f8c.pdf
    • http://nccsecec.org/uploads/1/3/0/5/130551536/lapupapotebes.pdf
    • http://dogtalephoto.com/uploads/1/3/0/8/130813848/580220.pdf
    • http://drreedallergydoctor.com/uploads/1/3/0/6/130639851/bewoziwopaz_gufanago_nemudu.pdf
    • http://beautifulsoulspa.com/uploads/1/3/0/6/130620974/fizidujepeniwak.pdf
    • http://latercomics.com/uploads/1/3/0/6/130640063/levovibararuxefixew.pdf
    • http://pmaaerospace.net/uploads/1/3/0/3/130313148/vaposotupaga.pdf
    • http://pmaaerospace.net/u

Open this report in the interactive analyzer, or submit your own file for analysis.