PDF malware analysis — malicious · f69399cd1a8ecbcc

MALICIOUS

PDF

46.3 KB Created: 2020-05-04 03:01:30 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: f06107ecc106f18853356184cc697b6b SHA-1: e7a22a0c3a406cfd8eed26b206436128716b54ec SHA-256: f69399cd1a8ecbcc18924ca9a31f6a14eee06e4c15c0bb17634ada3142807f0f

84 Risk Score

Malware Insights

MITRE ATT&CK

T1204.002 Malicious File T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document employs a lure by presenting itself as a 'debt snowball calculator excel spreadsheet' to entice users. It contains a significant number of external links, forming a link farm, with the primary goal of directing users to download malicious PDF files hosted on various domains. The heuristic 'SE_ENABLE_LURE' indicates the document likely instructs users to enable macros or editing, a common tactic for malware delivery.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Macro/content-enable lure medium SE_ENABLE_LURE

Document instructs the user to enable macros or editing — a common technique used by malware droppers to bypass Office macro security settings
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://cwhypnotherapy.com/uploads/1/3/1/3/131379946/131379946.html#debt+snowball+calculator+excel+spreadsheet
- http://crossngo-production.com/uploads/1/3/1/4/131438844/kibavadaditu.pdf
- http://pietroveronesi.com/uploads/1/3/0/8/130813616/jotemolodim.pdf
- http://brownwoodclimatecontrolledstorage.net/uploads/1/3/0/4/130436166/9616304.pdf
- http://nicole-carmody.com/uploads/1/3/1/6/131637342/6d39a.pdf
- http://arkconsultancyinc.net/uploads/1/3/0/2/130272442/goxada.pdf
- http://jubileemovement.com/uploads/1/3/0/2/130291624/4941862.pdf
- http://cypresscreekchronicles.com/uploads/1/3/0/5/130588248/lomotibokejadopu.pdf
- http://mainesungrown.com/uploads/1/3/0/7/130739264/ee5e934c26.pdf
- http://mackenzieblewis.com/uploads/1/3/0/3/130313428/9935405.pdf
- http://deidrescott.com/uploads/1/3/1/6/131637279/0eb7c157d3.pdf
- http://annachristiani.com/uploads/1/3/1/4/131453027/4054282.pdf
- http://styluspromotion.com/uploads/1/3/0/8/130813427/resudegunumozezilit.pdf
- http://hhehenryhamerenterprises.com/uploads/1/3/0/2/130270808/434fbb341e6.pdf
- http://limpio-plus.com/uploads/1/3/0/7/130775171/bijojepagazalapig.pdf
- http://ekidnap.com/uploads/1/3/0/6/130604411/naworiwi.pdf
- http://geleedegroseilles.com/uploads/1/3/1/4/131438747/wibos.pdf
- http://christopherberglundcareer.com/uploads/1/3/0/6/130604589/bafigon.pdf
- http://beachvacationgurubooking.com/uploads/1/3/0/7/130739247/1f07697754.pdf
- http://gkindustrialmachine.com/uploads/1/3/0/4/130488338/d5beaee7.pdf
- http://mrcharleys.com/uploads/1/3/0/6/130639779/d6f57dd652.pdf
- http://smashit2.org/uploads/1/3/1/1/131163956/3341301.pdf
- http://morgahni.com/uploads/1/3/0/6/130639885/komiwo.pdf
- http://reunionupcycled.com/uploads/1/3/0/4/130436139/ddb12c6cf8c4702.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000088ce.bin` `62aa5ab52d0cfa018ce591314600fcfedbdf19ffb6ee89c88ba08a901e8c95e1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x88CE	10828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.