Malicious PDF — malware analysis report

Static analysis result for SHA-256 f2611759d1af605c…

MALICIOUS

PDF

43.3 KB Created: 2020-04-21 09:58:24 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 20305befa53b3e5bdb8d967c1caa13c0 SHA-1: c912b1dba835b49a2ca89927d8ef50cd17eee4aa SHA-256: f2611759d1af605cee509ba919947b9d6c4a6cd26bdfd6b5de6997c6db1d327e
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains numerous external links, many of which are structured as a link farm. The document body contains language suggesting an invoice or financial statement, indicating a lure to trick the user into clicking these links. The primary link points to a page with 'debtors creditors balance sheet' in the URL, reinforcing the lure. No scripts were extracted, but the extensive link farm suggests a delivery mechanism for further malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://erincrumconsulting.com/uploads/1/3/1/6/131606789/131606789.html#debtors+creditors+balance+sheet
    • http://mybrothersnuts.net/uploads/1/3/0/9/130969842/tokogupowogoterojo.pdf
    • http://intelligenceit.org/uploads/1/3/0/5/130588216/mabilesodixorirel.pdf
    • http://soullinks.org/uploads/1/3/0/2/130271212/vimenutopusisakopuf.pdf
    • http://mrjmusic.org/uploads/1/3/0/6/130620685/ad84f.pdf
    • http://ziggycat.com/uploads/1/3/1/4/131453049/xewiw_tonitakuman_musasefunazedas.pdf
    • http://chefmikescharcoalgrill.com/uploads/1/3/0/7/130739261/3572123.pdf
    • http://lindamodernart.com/uploads/1/3/0/6/130620511/busukobem-kededimuwab.pdf
    • http://tobiasdykast.com/uploads/1/3/1/4/131437977/a5a495d3c9130.pdf
    • http://avnewsdaily.com/uploads/1/3/0/5/130543787/2236764.pdf
    • http://toncojewelryco.com/uploads/1/3/0/6/130605299/gadozevi.pdf
    • http://mdo.ca/uploads/1/3/1/4/131437333/faxatalanudibina.pdf
    • http://glynncountygranite.com/uploads/1/3/0/2/130289272/ditok.pdf
    • http://rivertoseainteriors.com/uploads/1/3/0/2/130272381/waluw.pdf
    • http://kjvcpa.com/uploads/1/3/0/8/130874365/842792.pdf
    • http://intelligenceit.org/uploads/1/3/0/5/13
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000809a.bin
0d4a89852a065ead5c2ef37905924453f03b62fbf40899081cb781f3e88f2807		 pdf-font-stream PDF embedded font (sfnt) at offset 0x809A 7916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.