Malicious PDF — malware analysis report

Static analysis result for SHA-256 ecd659b125b491bd…

MALICIOUS

PDF

39.0 KB Created: 2020-03-15 04:00:29 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: cea491cc928731b4301e68c5e0979656 SHA-1: 23fe030ac13177dd282ed501e814f4b5287a57ce SHA-256: ecd659b125b491bd7daa101eb28f6be14efbacb438563b073b97e0a883825311
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to distribute malicious content or redirect users to phishing sites. The presence of a 'download button' heuristic further suggests a deceptive user interaction is intended.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://she169.brdge.org/uploads/1/3/0/5/130588698/130588698.html#chemdraw+pro+11.+0
    • http://www.galdramenn.com/uploads/1/3/0/3/130313641/runilevunivajew.pdf
    • http://webdisk.windyhillacresinn.com/uploads/1/3/0/9/130968976/469475.pdf
    • http://protopgranite.com/uploads/1/3/0/2/130270894/gunufe_dogulowabusa.pdf
    • http://remodelacion.org/uploads/1/3/0/9/130969806/vebubamoxosixugo.pdf
    • http://www.worldwaternews.com/uploads/1/3/0/6/130604903/xijevakidogoju-novune.pdf
    • http://fluencybuilders.net/uploads/1/3/0/3/130313081/8b78eccec9645.pdf
    • http://healingcrystalenergies.com/uploads/1/3/0/4/130435988/zaxubu.pdf
    • http://urbanfoundation.at/uploads/1/3/0/4/130436299/deluxokurifa_gerexuvabiza_pofufunob.pdf
    • http://freebetdirectory.com/uploads/1/3/0/5/130550953/fd9bee2b811815.pdf
    • http://mytriangleofsuccess.com/uploads/1/3/0/7/130739983/520931.pdf
    • http://beasthoopsatx.com/uploads/1/3/0/2/130287871/f66f1c.pdf
    • http://theyearsbestwedding.com/uploads/1/3/0/5/130538986/pugupage_sunewuxowewi_jugivalituni_ruwujemixam.pdf
    • http://www.mrcampbellsmathclass.com/uploads/1/3/0/7/130738945/854cea136ff726.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006634.bin
f01dc44ca12cb595239e241df9e23f3d9e46c9607b169da895375738287d09e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6634 8492 bytes
font_01_sfnt_off0000866e.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x866E 1708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.