MALICIOUS
110
Risk Score
Malware Insights
MITRE ATT&CK
T1204.001 Malicious Link
T1566.002 Spearphishing Attachment
The PDF document contains a lure related to browser extension installation and fake invoices, aiming to trick the user into downloading further malicious content. It embeds a large number of external links, many pointing to PDF files hosted on various domains, suggesting a link farm or redirection mechanism. The primary attack pattern involves social engineering to prompt the user to click on these links, which likely lead to malware or phishing sites.
Heuristics 5
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Browser extension / update installation lure high SE_BROWSER_INSTALL_LUREDocument tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
-
Fake invoice / payment lure low SE_INVOICE_LUREDocument contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://wangluoqipaiyouxidaili.br3h.com/uploads/1/3/0/7/130740124/130740124.html#pan+card+change+form+latest
- http://ryansjewelryshop.com/uploads/1/3/0/4/130477890/126884efc.pdf
- http://www.ahtiras-africa.com/uploads/1/3/0/6/130621649/615b9278e.pdf
- http://sunnyvalecoffee.com/uploads/1/3/0/7/130775489/8987078.pdf
- http://mta-sts.mx.discovermichiana.com/uploads/1/3/0/5/130588415/23271.pdf
- http://ideasinaday.com/uploads/1/3/0/6/130639790/gakupusidotuxex.pdf
- http://delighteddaughter.com/uploads/1/3/0/2/130289765/7045898d.pdf
- http://troyharman.com/uploads/1/3/0/6/130639630/5651fa284e78.pdf
- http://shuttcv.com/uploads/1/3/0/4/130477048/5823805.pdf
- http://justafirstdraft.com/uploads/1/3/0/2/130272095/7840170.pdf
- http://btravels.co.za/uploads/1/3/0/5/130539783/xezonunomi-tubofanurigusez-kasajevupo.pdf
- http://webdisk.loikitsoil.com/uploads/1/3/1/0/131071167/morokaluwa.pdf
- http://aurasalontn.com/uploads/1/3/0/3/130379357/dovad.pdf
- http://lizrudey.com/uploads/1/3/0/8/130814716/8967192.pdf
- http://germanaudiospecialties.com/uploads/1/3/0/5/130543569/31267025337b462.pdf
- http://www.roopagangopadhyay.com/uploads/1/3/0/2/130272247/zuxubanavobajajot.pdf
- http://allabouthomerecording.com/uploads/1/3/0/2/130271154/9500394.pdf
- http://hostmaster.astuteexercisephysiology.com.au/uploads/1/3/0/7/130739713/videxusivusegof-rovejavovimo-dobuzelavenol-zarozikol.pdf
- http://e-y-o-6.com/uploads/1/3/0/6/130621457/mepijinefipal.pdf
- http://emilydowlingfriedman.com/uploads/1/3/0/4/130483207/10207d443.pdf
- http://www.superbdave7771and1.com/uploads/1/3/0/4/130435941/9e55c6eadf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 1
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00008fab.bin77a2a90644db449a03844b1e9650b8bba3c8a976f29cb50bfecd4d6a6f80af09 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8FAB | 7828 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.