Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3b8915193794795…

MALICIOUS

PDF

40.1 KB Created: 2020-04-08 23:17:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: c834b9f27876ed5b98bc6474f3994cc7 SHA-1: 2690477a93c2f82da32c94d43a0c8eec2f01e354 SHA-256: f3b8915193794795183875fda907bbf59c289e877efc073f4d7ea5f6f4703daf
70 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains a URL that appears to be a lure for an 'answer key'. The presence of numerous links to external PDF files suggests a link farm or a distribution mechanism for further malicious content. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bettys-tesalong.com/uploads/1/3/0/3/130323601/130323601.html#gizmos+answer+key
    • http://aegisdefenders.com/uploads/1/3/1/4/131483018/59ffb22c973.pdf
    • http://dujamenterprise.shop/uploads/1/3/1/3/131383581/7289779.pdf
    • http://pmpclones.com/uploads/1/3/0/7/130776110/e5184.pdf
    • http://3guysautoanddetail.com/uploads/1/3/0/2/130288439/vedupudu.pdf
    • http://ashleighmanning.com/uploads/1/3/0/7/130775017/pagofeluzosu.pdf
    • http://eirdesign.ie/uploads/1/3/0/3/130379126/luluwivo.pdf
    • http://nameastartoday.com/uploads/1/3/0/9/130969462/9760153.pdf
    • http://singseng.com/uploads/1/3/0/3/130313405/xilajajakeriwareg.pdf
    • http://alyeskawolves.com/uploads/1/3/1/4/131408537/9d333ea21.pdf
    • http://rtbseo.com/uploads/1/3/0/8/130874587/3304860.pdf
    • http://tammykjohnson.com/uploads/1/3/0/6/130604981/wonamal-ladusewowezo.pdf
    • http://linwoodpto.com/uploads/1/3/0/8/130874252/murokabamotutoregu.pdf
    • http://encorstrong.org/uploads/1/3/0/6/130621392/4051d5a70.pdf
    • http://prettybritty.com/uploads/1/3/0/5/130590353/3803721.pdf
    • http://mail.facialsbyjada.com/uploads/1/3/0/2/130291689/wemow_ziwepavolepisul_sakipop_fawowebowedeba.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007654.bin
45ac72c7a993367ff60b3d66752a64e0e047bab16a5bd1d8a97b235a12bf0da8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7654 9140 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.