Malicious PDF — malware analysis report

Static analysis result for SHA-256 f157b3cf1d1df694…

MALICIOUS

PDF

35.4 KB Created: 2020-05-31 04:51:04 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)
MD5: bf2b592bf2cd245223f4057380d66d94 SHA-1: 2b5bf799b43c457613932eba754d3d3759363249 SHA-256: f157b3cf1d1df694bd32a8e44a689a866c0530899c3c79e7a3d3d7c7e0353d9f
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The document body also contains a URL related to downloading Pokemon Crystal, suggesting a lure. The presence of numerous unknown reputation URLs points towards a malicious distribution campaign. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vermontyogaretreats.com/uploads/1/3/0/4/130488829/130488829.html#pokemon+crystal+download+gba+pt+br
    • http://e3renewables.com/uploads/1/3/1/3/131384298/jotudexakaxi_baxigolaxuf_wizetade.pdf
    • http://hostmaster.chipfoundation.org.au/uploads/1/3/0/6/130621130/1348375.pdf
    • http://brookebarberfit.com/uploads/1/3/0/5/130590596/gagirev.pdf
    • http://uticaforall.org/uploads/1/3/0/5/130540869/6d0cdaec51d.pdf
    • http://bernalmusic.com/uploads/1/3/1/4/131438257/9802755.pdf
    • http://hostmaster.tapping-point.com/uploads/1/3/2/3/132303388/geguk.pdf
    • http://nataliashand.com/uploads/1/3/0/5/130551619/5973711.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005c3a.bin
f5b7fae8d79995ed9e9916f99dd382e1ecf745f01a6e89f7d7d3018f9fdd2484		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C3A 12144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.