PDF malware analysis — malicious · 2d14f5d096dd98aa

MALICIOUS

PDF

43.9 KB Created: 2020-03-28 03:13:27 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: bee31e412acf3e7f62e3cd41f1a61dc2 SHA-1: 468e7550778bf9cb16d0c704b349fbd28d371255 SHA-256: 2d14f5d096dd98aa087dba48bda8236559c46fa6f051d6a8785c07153c957062

92 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body contains Spanish text related to a restaurant project, which may serve as a lure. The primary function appears to be directing users to a network of linked PDFs, potentially for SEO spam or to host further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://harrisonrappaport.com/uploads/1/3/0/6/130604257/130604257.html#proyecto+para+restaurante+bar
- http://danfitts.com/uploads/1/3/0/6/130620372/815ebdca1baa4b.pdf
- http://admin.doublefreethink.co.uk/uploads/1/3/0/3/130379298/gosapokofejos-nodanifabofuwe-marumisoduj.pdf
- http://baoxian2.co.za/uploads/1/3/0/3/130323762/simudipo-dixim-dojuki.pdf
- http://dunebeat.com/uploads/1/3/0/5/130588685/puduxoziduvevap.pdf
- http://rumblejewels.net/uploads/1/3/0/8/130874623/gakuvid-xuzatog-pokepa.pdf
- http://alaalohagirlsstate.org/uploads/1/3/0/7/130739542/deban_judafi_daxanitaxuz.pdf
- http://zenlilymusic.com/uploads/1/3/0/6/130604626/xanutudisuxu.pdf
- http://mx.kim-bella.com/uploads/1/3/0/7/130740297/8960613.pdf
- http://www.sunsetcafechicago.com/uploads/1/3/0/5/130588502/taxakasixegesob_lewixozasidaw_gokoliv_pepawori.pdf
- http://vaviyod.sites.logojoy.com/uploads/1/3/0/7/130775570/kitidavomuvonozudax.pdf
- http://www.lovelustboudoir.com/uploads/1/3/0/4/130435881/nuratop.pdf
- http://edushareasia.com/uploads/1/3/0/9/130969173/2366177.pdf
- http://www.jasonetonscott.com/uploads/1/3/0/5/130546538/kixisebi-tuponobimupa-vonube.pdf
- http://sweetarthilo.com/uploads/1/3/0/2/130288818/rotoroxef.pdf
- http://byjingo.biz/uploads/1/3/0/5/130588334/7273143.pdf
- http://freelanceombudsman.com/uploads/1/3/0/7/130776006/3e083f.pdf
- http://www.agoodtalker.com/uploads/1/3/0/6/130604256/tunitezuvix-ramezewosakek.pdf
- http://www.funkytownpedicab.com/uploads/1/3/0/6/130639875/bidetevedidelis.pdf
- http://mta-sts.mx.annualmuster.com/uploads/1/3/0/9/130969631/9864449.pdf
- http://fridaycastshow.com/uploads/1/3/0/7/130740199/2062121.pdf
- http://fastflowdrainplumbing.com/uploads/1/3/0/6/130621284/54791.pdf
- http://secretgourmetpicnic.com/uploads/1/3/0/6/130605174/2650577.pdf
- http://siyuanlipiano.com/uploads/1/3/0/4/130483632/nipitabosojejax_bedozikiso_roboke_wufojudulomu.pdf
- http://siyuanlipiano.com/uploads/1/3/0/4/130483632/nipitabosojejax_be
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007f79.bin` `c8e90f2368bb17cea2d653f45e31fa7eb1cc5be4640f41df6941bfbe236d4414`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7F79	9084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.