Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec11e482c706d5af…

MALICIOUS

PDF

38.0 KB Created: 2020-06-04 21:08:51 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: 07abee685cd7f9e3c725cec30ffd79f3 SHA-1: 2471988d8ec731d4a45084b459002517af555fae SHA-256: ec11e482c706d5af19dba3f04a8c59251470fe2ec8c477d65c1dd0cdb97a5c3b
70 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link T1566.002 Spearphishing Attachment

The PDF file contains numerous embedded URLs, many of which are part of a link farm designed to appear as search results. The document body, though heavily obfuscated, contains a reference to "Star wars mp4 free download" and includes URLs that likely lead to malicious content. The PDF_SEO_LINK_FARM heuristic firing indicates a deliberate attempt to create a large number of links, suggesting a malicious distribution or redirection scheme.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://outofthewoodsheather.com/uploads/1/3/0/5/130550880/130550880.html#star+wars+mp4+free+download
    • http://schurrassociates.com/uploads/1/3/0/6/130604024/muredeneso_sawilexazurugov_lowupepi_xapapoxezof.pdf
    • http://us-11-2.octarinesec.com/uploads/1/3/0/7/130775119/vifavoraledex.pdf
    • http://lashtowncleveland.com/uploads/1/3/0/6/130620758/vitujumanazoxep.pdf
    • http://madisonandarveentietheknot.com/uploads/1/3/0/6/130621185/6336706.pdf
    • http://mindfulcare.nl/uploads/1/3/0/5/130588370/xunojukurinab.pdf
    • http://hcsuperpac.com/uploads/1/3/0/7/130739206/8708664.pdf
    • http://tereden.com/uploads/1/3/0/2/130289205/rejepejawix-putakiweketevu-dalabagezav-mudobero.pdf
    • http://mboss.thelenoreinc.com/uploads/1/3/0/2/130289265/vefapirajeva_gozilarilit.pdf
    • http://outofthewoodsheather.com/uploads/1/3/0/5/130550880/terms.html
    • http://outofthewoodsheather.com/uploads/1/3/0/5/130550880/dmca.html
    • http://outofthewoodsheather.com/uploads/1/3/0/5/130550880/policy.html
    • https://vevivumofid184091929.files.wordpress.com/2020/06/zopogebuzesi.pdf
    • https://dukedelumik.files.wordpress.com/2020/06/33866035446.pdf
    • https://sazojefos.files.wordpress.com/2020/06/9399935939.pdf
    • https://sexobonuva.files.wordpress.com/2020/06/6678639395.pdf
    • https://nosuvul.files.wordpress.com/2020/06/35584741642.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006559.bin
907cad64f76cc1ef831091fe468e9ea8ac07deba44cbcae3280af077adf130de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6559 13056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.