Malicious PDF — malware analysis report

Static analysis result for SHA-256 fc444a259578111c…

MALICIOUS

PDF

23.1 KB Created: 2020-03-21 01:46:25 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 64aecde593c7e273dc4a7546573f3b33 SHA-1: 6e92864bf70f4d5c1962af40771761a6bc9e875d SHA-256: fc444a259578111c16c9f85381d5fb169aaaf6c1e5005f504c3d478bbeef0e16
82 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file is identified as an image-only lure, typical of phishing campaigns. It contains numerous external links, suggesting a link farm or redirection mechanism to host malicious content. The primary URL, http://armortoolcovers.com/uploads/1/3/0/8/130874580/130874580.html#2004+jetta+owners+manual+free, is likely the initial point of contact for the user. No scripts were extracted, but the structure strongly indicates a social engineering attack.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 23 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://armortoolcovers.com/uploads/1/3/0/8/130874580/130874580.html#2004+jetta+owners+manual+free
    • http://www.theintegratedclassroom.com/uploads/1/3/0/8/130814676/d48a73e76e.pdf
    • http://www.yourkitchenpantry.com/uploads/1/3/0/6/130639503/kusowobasoxow.pdf
    • http://www.vredenburgwoodworking.com/uploads/1/3/0/5/130551718/1650023.pdf
    • http://susanbrookscommunications.com/uploads/1/3/0/5/130540186/kebon.pdf
    • http://www.fioruccistore.com/uploads/1/3/0/5/130588269/sawokut.pdf
    • http://naylorbythewater.net/uploads/1/3/0/6/130604449/fuzewubi.pdf
    • http://www.harrietbalcombe.com/uploads/1/3/0/5/130546486/nojal.pdf
    • http://swimmingwithoutborders.org/uploads/1/3/0/7/130739742/5505609.pdf
    • http://www.pas-de-chat-104119square.com/uploads/1/3/0/5/130589396/340fa0.pdf
    • http://www.operafriendsforchildren.org/uploads/1/3/0/6/130639397/98533.pdf
    • http://newedgeroofing.com/uploads/1/3/0/6/130620454/sowimeril-mufenozomuwo-bafad.pdf
    • http://senatoribrahimhadejia.com/uploads/1/3/0/6/130621472/9168163.pdf
    • http://redwoodvisualarts.com/uploads/1/3/0/4/130435581/foledosusikasek-kemufa-bodobuzug-sewok.pdf
    • http://radiancetherapyspa.com/uploads/1/3/0/5/130550660/nufumati-rodepimeguluxod-sepikulexatuga-wixogerefa.pdf
    • http://bacalandersengarrison.com/uploads/1/3/0/4/130488227/beruvatafexegowela.pdf
    • http://gslpgtroop147.com/uploads/1/3/0/8/130814353/7950429.pdf
    • http://molokaishores.info/uploads/1/3/0/6/130639166/peseketuzepojip.pdf
    • http://tabjs.com/uploads/1/3/0/3/130324126/8367394.pdf
    • http://www.joanadrussell.com/uploads/1/3/0/9/130969957/1c2436011e5c54.pdf
    • http://tomsettplumbing.com/uploads/1/3/0/6/130603945/kitugelutuwakule.pdf
    • http://mail.kidsbehaveaid.com.au/uploads/1/3/0/5/130590596/7159794.pdf
    • http://www.oiledforlife.org/uploads/1/3/0/9/130969508/5611162.pdf
    • http://jrsmortgages.com/uploads/1/3/0/5/130588627/fumapunirele.pdf
    • http://lbtowingservices.com/uploads/1/3/0/7/130740207/pewuboruwexak.pdf
    • http://johnnyoconnor.com/uploads/1/3/0/6/130621436/3d1a9.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.