Malicious PDF — malware analysis report

Static analysis result for SHA-256 e633591491c3112d…

MALICIOUS

PDF

134.2 KB Created: 2020-03-07 20:05:28 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c17e9bbbe40440cfdba2d3934637ca2f SHA-1: ed70eb24cbe443a682e5210d89d698efda9617b0 SHA-256: e633591491c3112d2b6547ee448a5167fe6aea6bbeabe1f4eec0e884ebf003f8
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to PDF files on various domains, suggesting a link farm or SEO poisoning tactic. The document body, though heavily obfuscated, contains a URL that appears to be related to 'dengue pathophysiology medscape'. The presence of a 'SE_URGENCY_LURE' heuristic further indicates an attempt to trick the user into clicking the malicious links. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sustainablefleet.com/uploads/1/3/0/6/130621321/130621321.html#dengue+pathophysiology+medscape
    • http://saintmatthewsfestival.com/uploads/1/3/0/7/130739658/wuvodebe.pdf
    • http://apexairsoftus.com/uploads/1/3/0/2/130287529/kedisigexi.pdf
    • http://ship504.com/uploads/1/3/0/6/130621421/mimeref.pdf
    • http://maurizio-esposito.com/uploads/1/3/0/2/130272988/3029040.pdf
    • http://dannybazilriley.com/uploads/1/3/0/5/130588973/a4f9daf.pdf
    • http://evacamarenadesigns.com/uploads/1/3/0/4/130476053/ac14311.pdf
    • http://mail.yanivtaubenhouse.com/uploads/1/3/0/4/130483860/2a60afe085ed5.pdf
    • http://dipagnu.com.br/uploads/1/3/0/5/130550715/6b8bf096d31.pdf
    • http://oeufrier.ca/uploads/1/3/0/5/130545098/1d7d12725446482.pdf
    • http://ashevillecarpetcleaning.org/uploads/1/3/0/5/130550712/finijikadotixujeloj.pdf
    • http://www.blackgirlswandering.com/uploads/1/3/0/2/130291390/wunotavakim_kapapizap.pdf
    • http://nectaralchemy.ca/uploads/1/3/0/9/130969483/retavik.pdf
    • http://tennesseestillhouse.com/uploads/1/3/0/5/130544968/gipirabi.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0001db3c.bin
640e68f9a163b69773e48ca8c17cd0e1825859fd85377587a0c8f364777e3128		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DB3C 10336 bytes
font_01_sfnt_off0002006b.bin
1110447959503c75238c0f1bcdf9de7fad567fc767730a4530dcb0d3a64541bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2006B 2696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.