Malicious PDF — malware analysis report

Static analysis result for SHA-256 f53d92816f3ed6cb…

MALICIOUS

PDF

40.3 KB Created: 2020-03-24 03:01:19 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: df49fcbe17ecf278f7d7472ab9b97358 SHA-1: 5f99ea2a59205de3fe8be81d55c2ae984a2605a8 SHA-256: f53d92816f3ed6cbde81f537d8b0bd6b41b6c2d217a17241a6dde7847c7b3147
72 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which are structured as SEO gateway links, suggesting a link farm or redirection scheme. One of the embedded URLs, http://harmonyhomesusa.com/uploads/1/3/0/6/130640025/130640025.html#pinnacle+studio+14+descargar+gratis+softonic, is presented in the document body and appears to be a lure for downloading software. The presence of numerous similar PDF files hosted on various domains indicates a coordinated effort to distribute malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://harmonyhomesusa.com/uploads/1/3/0/6/130640025/130640025.html#pinnacle+studio+14+descargar+gratis+softonic
    • http://julielanctot.com/uploads/1/3/0/7/130776141/mejalez.pdf
    • http://www.reikiisagift.com/uploads/1/3/0/7/130775111/98ef03b867.pdf
    • http://phxkind.com/uploads/1/3/0/7/130738625/tezewozupaforivu.pdf
    • http://ihpdm1.com/uploads/1/3/1/0/131070238/gumekesemolodolomu.pdf
    • http://makam.ca/uploads/1/3/0/2/130287457/08571dcc6edd4d6.pdf
    • http://breederseed.com/uploads/1/3/0/3/130324112/f4c035.pdf
    • http://shannonkiernanlmt.com/uploads/1/3/0/7/130739640/jowefilofev.pdf
    • http://mmcarterconsult.com/uploads/1/3/0/5/130539348/pogoxidolap_damibolilelefuw.pdf
    • http://www.cateringhayet.nl/uploads/1/3/0/7/130739653/37ef31ae.pdf
    • http://cheapestphotoscan.com/uploads/1/3/0/4/130436018/xipafuxen.pdf
    • http://salsmantour.org/uploads/1/3/0/7/130739472/1115e47555.pdf
    • http://viviannixon.org/uploads/1/3/0/3/130323835/zidimusasiluvos.pdf
    • http://allisonlynne.com/uploads/1/3/0/4/130478772/2905151.pdf
    • http://nextcap.us/uploads/1/3/0/6/130603858/05003.pdf
    • http://www.comprasusashop.com/uploads/1/3/1/1/131164223/zanip_mowajedesi.pdf
    • http://lifehub.org/uploads/1/3/0/5/130539990/e376abff3d63.pdf
    • http://puppyparentpro.com/uploads/1/3/0/5/130590177/mexuzav_venulis_nijib_mujikila.pdf
    • http://erincrider.org/uploads/1/3/0/6/130640092/wujizumez_difaxanu.pdf
    • http://neurodesignlab.com/uploads/1/3/0/2/130272994/9248466.pdf
    • http://timelineofindia.com/uploads/1/3/0/5/130541028/wisiberajutudip.pdf
    • http://www.squareupfitness.com/uploads/1/3/0/7/130738751/jodopimifaziwuliso.pdf
    • http://www.culturalatinamag.com/uploads/1/3/0/5/130544652/3621352.pdf
    • http://www.islandmaidhawaii.com/uploads/1/3/0/8/130814421/sutavef.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000703b.bin
e70c15ba9c2fe58f0f7ec5e6560fe105331c674b957bd41c000d8095f1a58ce6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x703B 9072 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.