Malicious PDF — malware analysis report

Static analysis result for SHA-256 f480368024a073ee…

MALICIOUS

PDF

53.1 KB Created: 2020-05-13 19:43:35 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 3fd4c0e446f7295ce83e2aa2475765e4 SHA-1: 9219920d11e7e93c02bfa68b8e08a5afd5147ded SHA-256: f480368024a073ee261b79e7c0f32847765c21c27866d5c157445bc6a2fc9aa8
102 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a large number of external links, indicating a link farm or SEO manipulation tactic. The heuristic 'SE_LOLBIN_RUN_COMMAND' suggests that the document may contain instructions for executing Windows scripting tools, potentially to download and execute further payloads. The primary intent appears to be directing users to a multitude of external sites, with the specific malicious action dependent on the content of those linked pages.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://spectrumherniaclinic.com/uploads/1/3/0/5/130540193/130540193.html#linear+sequences+worksheet+year+6
    • http://kkmediaagency.com/uploads/1/3/0/5/130539798/b24492.pdf
    • http://rtatriaddevelopment.com/uploads/1/3/0/5/130541597/gonarafuga-juxazodoj.pdf
    • http://fiestaharborcruisesinc.org/uploads/1/3/0/3/130324092/4819264.pdf
    • http://montellossimplyhomemade.com/uploads/1/3/0/7/130738919/bazulukaje.pdf
    • http://calvarybcsa.com/uploads/1/3/0/5/130590596/nanabete_sikafeviber_parogiwupetuvug.pdf
    • http://nataliesoulardcalligraphy.com/uploads/1/3/0/6/130604758/993104.pdf
    • http://blackovaldiesel.com/uploads/1/3/0/4/130476978/gopedul.pdf
    • http://wildernesshomeinspection.com/uploads/1/3/0/4/130483385/sunir.pdf
    • http://hvga.net/uploads/1/3/1/4/131437376/bezidojaj.pdf
    • http://12741homanavenue.com/uploads/1/3/0/6/130621432/fiderikesuvesufojov.pdf
    • http://tamoy87.com/uploads/1/3/0/2/130270897/8562260.pdf
    • http://joyceandcraig.com/uploads/1/3/1/4/131406154/890339.pdf
    • http://dtailspetboutiquespa.com/uploads/1/3/1/4/131408248/4881717.pdf
    • http://mrobichaux.org/uploads/1/3/0/3/130313453/nizetomusije.pdf
    • http://emilycurl.com/uploads/1/3/0/7/130775014/5e3b17932c48269.pdf
    • http://priteashop.com/uploads/1/3/0/2/130274370/973dd7425cec.pdf
    • http://culinarianconcierge.com/uploads/1/3/0/3/130313004/jikipe-wuzojawib-sataku.pdf
    • http://red-dot-prop.com/uploads/1/3/0/4/130476308/9738223.pdf
    • http://northportleadership.com/uploads/1/3/0/5/130590142/9db5651ce6c.pdf
    • http://yellowfoxprototyping.com/uploads/1/3/0/7/130739313/xumesub-renokoza.pdf
    • http://9146718265315491.me/uploads/1/3/0/7/130775156/8735768.pdf
    • http://danaselvis.com/uploads/1/3/0/2/130291623/6178c5ec90.pdf
    • http://fullcircularity.com/uploads/1/3/0/4/130476786/dacb8.pdf
    • http://hrmhack.org/uploads/1/3/1/4/131407110/tuduvapuga_xasuwaw_lojetopatunapi_wezuzevirele.pdf
    • http://nataliesoulardcalligrap
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000a24e.bin
c37b1b57759c995bd01267833d184e22c5f1d21103db8b2ae65c67d77dbfc1d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA24E 11168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.