PDF malware analysis — malicious · 244016fda6b21a0f

MALICIOUS

PDF

35.2 KB Created: 2020-03-23 10:28:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 8cb67807dc1fb2ee0f67765022a91063 SHA-1: b66216c9155327bf4251ecbb761949836293e32c SHA-256: 244016fda6b21a0fefa0e995040658a96c6c50a4d410c564e057af014badcd2f

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF document contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The document body mentions 'Kocaso tablet hard reset', suggesting a lure to attract users to these external sites. No scripts were extracted from this sample, and the primary malicious activity appears to be directing users to a network of potentially malicious or spam-related websites.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://televisetvnow.com/uploads/1/3/0/6/130604801/130604801.html#kocaso+tablet+hard+reset
- http://trademasters.designpreviewer.com/uploads/1/3/0/3/130323455/2f32de8.pdf
- http://muaarchi.com/uploads/1/3/0/7/130776878/vebasun_wines.pdf
- http://www.lawhornfamilyinsurance.com/uploads/1/3/0/3/130379062/roreremabatigodezup.pdf
- http://marcopizano.com/uploads/1/3/0/4/130436410/5939189d8.pdf
- http://rmgdevelopmentgroup.com/uploads/1/3/0/5/130588857/ed5948d.pdf
- http://bsiinvisto.com/uploads/1/3/0/2/130272381/xupim_zamiponomixe_powupapavup.pdf
- http://thebellyisboss.com/uploads/1/3/0/4/130476778/mojirexi-talopotirom.pdf
- http://ieibr.com/uploads/1/3/0/5/130547450/4682189.pdf
- http://midwestspiritcare.com/uploads/1/3/0/5/130551416/8053312.pdf
- http://ubs-taxfreelosses.com/uploads/1/3/0/4/130476657/a9ce4d5fc1db6.pdf
- http://www.inspiringmummyclub.co.uk/uploads/1/3/0/5/130539810/werobanejarajisupomo.pdf
- http://koldenpianolessons.com/uploads/1/3/0/2/130289189/baxiguwitufil_sajigok.pdf
- http://folkswall.com/uploads/1/3/0/6/130639147/2818313.pdf
- http://hongheguojiyulehuisuo.br3h.com/uploads/1/3/0/6/130605228/mejosavidorutox.pdf
- http://tomtutinodesign.com/uploads/1/3/0/4/130435673/gagipafamufoj_giwaxovemejigos_petub.pdf
- http://www.cincin-bar-risto.com/uploads/1/3/0/4/130476273/dc7b978.pdf
- http://italeatherbags.com/uploads/1/3/0/4/130489240/sawofojesij-vepinibefowuku-tuxipibibonu.pdf
- http://rvamama.com/uploads/1/3/0/5/130551190/mabab.pdf
- http://lsboudoirlondon.co.uk/uploads/1/3/0/7/130776314/084fd7eb5366.pdf
- http://trialbyscience.net/uploads/1/3/0/3/130323647/6c5b21d8a6bb86e.pdf
- http://govanmbeki.com/uploads/1/3/0/8/130874133/wimumij-kagetu.pdf
- http://webdisk.pratasabavacation.com/uploads/1/3/0/6/130639464/7143bb96a5399fa.pdf
- http://vouchermarketing.com/uploads/1/3/0/3/130324004/setomo_zigevutokewibav_velowonozise_pedosu.pdf
- http://emzartworx.com/uploads/1/3/0/6/130620380/9687386.pdf
- http://vouchermarketing.com/uploads/1/3/0/3/130324004/setomo_zigevutokewibav_velowono
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000627c.bin` `8c9bb29e0be637e030b830a2846758b5b266bafd11ffa2f8259e20e20450ecc4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x627C	7324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.