Malicious PDF — malware analysis report

Static analysis result for SHA-256 f41cb2b163e4a9a2…

MALICIOUS

PDF

60.0 KB Created: 2020-04-05 03:40:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 2e671f28f9fcce951b75812fd5155c63 SHA-1: 0e863840b29fd2ea6b35a78691e01041c8b9e391 SHA-256: f41cb2b163e4a9a211abcdbc5fab6dc68c200a3ec6708855c0006d8d75068966
104 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files, suggesting a link farm designed to manipulate search engine results. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates the document's content is intended to defraud the user through a fake prize or delivery scheme. The embedded URLs likely serve as part of this lure, directing users to further scam-related content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kellyvaughn.org/uploads/1/3/1/4/131438718/131438718.html#honda+cbr+600+rr+2003+top+speed
    • http://chloeboyle.com/uploads/1/3/0/2/130288565/penug.pdf
    • http://bkhgroup.net/uploads/1/3/1/4/131453054/famizezariputevukos.pdf
    • http://robinsonwood.net/uploads/1/3/1/4/131437701/e9545fd.pdf
    • http://buylitecoinmalaysia.net/uploads/1/3/0/3/130379959/1315193.pdf
    • http://www.genpromotion.eu/uploads/1/3/1/0/131070407/nakoje-setulefas.pdf
    • http://scent.life/uploads/1/3/0/6/130621495/tewapebesafopu.pdf
    • http://ucccm.com/uploads/1/3/1/4/131407687/a2ba6766e1.pdf
    • http://bazarkidseua.com/uploads/1/3/0/4/130483509/473929.pdf
    • http://codfishhill.com/uploads/1/3/0/6/130605156/cb61221f787b.pdf
    • http://samdix.net/uploads/1/3/0/7/130740124/pisujibixubo.pdf
    • http://psylanguage.com/uploads/1/3/0/8/130874600/nasapiwafeve.pdf
    • http://smell-me-love-me.com/uploads/1/3/0/6/130605168/1f8049017cadc9.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000c37e.bin
f11c3beb2aba36f4e805dd22ffca966eee9b388450584c6a23c274ab79d098b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC37E 8088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.