PDF malware analysis — suspicious · 14b57e004e3aa02c

SUSPICIOUS

PDF

87.4 KB Created: 2016-12-27 06:26:59 +08:00 First seen: 2018-10-07

MD5: 4f10bedc445235fbd865132cec73c534 SHA-1: 015d5b62d6b94acce6a28f81deffe333e7920df9 SHA-256: 14b57e004e3aa02c5f1cb03459815067dc323b7de05477aa3ce0cd0500a5b5ee

34 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.0473

Heuristics 3

PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM

PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/JJlrnwYvz_uuskxJltovJP16216440J.pdf PDF link annotation
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/_w_GrscwufeQ16216225ba.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ofimtflzsmcbvGbutm_dYQbknww16216545txo.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/acPsPzc16217058vfYs.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/_rrlozwGYJhdGrbhna16216765bm.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/fktnhwxskP16257922J.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/osmrumbav16217013bf.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/hxae_sclsiPbJzYicvtfe16217123todJ.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/caGz16216697kx.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/_vbeewnchbvmaYsQGd16216397cbYz.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/xvQrxnQoQxmcG_xQeikJl_w_zmQc16217137iaG.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/PncimcPkarzafl16216415f.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/cPmdQJnd_mlult16216625wls.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/axbGnwdhQ16216580vke.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/odJa_nwawlzxrfuvronsmGuPffxm16217025_nPr.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nsbPJicbhmxhzclobhtukQbzn16244616G.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/kYw_Ylscfl_stiPtnnGhccrYb16217068rtw.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/iYhdGnsteGJJdGzY16216803nxi.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/kofwQPxsJwksQlGlbr16244625Gm.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nJrQzeonzrr16244621Y.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nQlmfh16244572kG_u.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ciPiivlwh16217082_.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/hlwPevodxkksfozxkef_xtbPJbdJd16216880zzw.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/tawfwsaocbf16216704w_Q.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ouQzYfl16217119k.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/i_rrediGbiuolkrrms_oPJ16216424hasf.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/u_fPm_llhiQQtvubbflPzQmtkkoYus16244726JPb.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/bYJnitzaobrJtftanfliktkxJ16217118l.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/xncwJbbkaYtoYofivkmtcmvtrnG16216185km.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/QfmdxQa16216425lb.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nzdPrPYmtPbzGQivJeuhfcehkf16216641kPza.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/QGPwroaQxzboGhz_wmzkYmYzkilr16217041fu.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/blvJ16216591z_zh.pdfIn PDF document text
- http://www.citrusheightsplumbing.net/tmp/ewkQtQrJ15773827lka.pdfIn PDF document text
- http://www.citrusheightsplumbing.net/tmp/YYfJa_fszoQlmvvwwaaex_ccoePlsl15645165vrw.pdfIn PDF document text
- http://www.zerodeuxsix.com/foYufsQrdJbGvv4585858.pdfIn PDF document text
- http://cardoor.es/learnfire/_eilboGws15546787fP.pdfIn PDF document text
- http://www.toledano.fr/logs/Yhx15871271mfo.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/etlcbbbshcQlk_cmkrJlrYdfuhY16257821rmt.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/kJkwkPJc16244737sPJ.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nzaf__xQQJ16216696uzu.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/lnnrxikivwcdoz16244555Pms.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/zrnlea_GGiumQadssibYrePr16216214knaY.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/PekoiQ_unb16216419PbvQ.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/dPP16216872G_be.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/PbwbJvJYt16244776kYQh.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/PfhuiYmsalczlPlkt___dwPno16216991fP.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nJfofwfoczPifwafmoa_16216899souk.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/akthPcswruY16217052_mGa.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/reexneux_hJnxJoGlewr16216733z.pdfIn PDF document text
+26 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000b6e8.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB6E8	19856 bytes
SHA-256: `a930245e90be17a336a7679d31e9d416ddec66c65020bec75b59b2e2bfc19120`
`font_01_sfnt_off0000ec7a.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xEC7A	19964 bytes
SHA-256: `5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8`
`font_02_sfnt_off0001223d.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1223D	20828 bytes
SHA-256: `66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1`

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Machine Learning

Heuristics 3

Related samples 8

Extracted artifacts 3