Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3fe16ddec21ec6e…

MALICIOUS

PDF

43.8 KB Created: 2020-04-15 06:26:30 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 93fa092596e19de0f810c01e73b1706d SHA-1: 9ffc7dfa13678f8d3d9bc6a65f46471f295294da SHA-256: f3fe16ddec21ec6e6ea21d34d4541b0444b98066360f241884736bbb75bc2559
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1059.001 PowerShell

The PDF document contains a large number of external links, a common technique for SEO spam or directing users to malicious sites. The document body mentions 'Activesheet. showalldata does not work', which may be a lure to encourage users to click on the embedded links for a supposed solution or further information. No scripts were extracted, but the extensive link farm suggests a delivery mechanism for further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://joyofphysics.com/uploads/1/3/0/8/130814235/130814235.html#activesheet.+showalldata+does+not+work
    • http://michellewatsonlaw.com/uploads/1/3/0/4/130483766/2102668.pdf
    • http://ofiretku.xyz/uploads/1/3/1/3/131384359/pebofavalivebe-lamisabavekus.pdf
    • http://jmbservicereports.com/uploads/1/3/1/3/131383678/222783.pdf
    • http://infinityapproach.com/uploads/1/3/1/4/131453493/4544163.pdf
    • http://yolandaluna.net/uploads/1/3/0/6/130605381/3058c6c.pdf
    • http://mypccabenefits.com/uploads/1/3/1/1/131163917/wavaraxagabu-tanuwazujew-bigovu-danafinu.pdf
    • http://elementresources.net/uploads/1/3/1/3/131398431/2636557.pdf
    • http://darlingtreefarm.com/uploads/1/3/1/3/131379012/8447a504d5bf9.pdf
    • http://kmsanteadomicile.net/uploads/1/3/0/7/130739850/2894692.pdf
    • http://starburstactivation.org/uploads/1/3/0/5/130588214/c4c534c159.pdf
    • http://jcumc.org/uploads/1/3/0/7/130739661/sumojarolizogu_fepetepa_vurevututanug_wuwexipelokutip.pdf
    • http://gianniyoung.com/uploads/1/3/0/5/130543663/kenisejan-roxijozo.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000080ed.bin
a8141fc1540b9c4e038ca836b0e4a3db45b4be8fb058ce6b0f1d38a5720b5228		 pdf-font-stream PDF embedded font (sfnt) at offset 0x80ED 8872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.