PDF malware analysis — malicious · 32921abadbce5add

MALICIOUS

PDF

41.3 KB Created: 2020-04-02 12:18:34 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 4f6fd8cfaf71ce769d99fa1307142d69 SHA-1: d7a43e1376cea702d8d038bc94e868083d7ec888 SHA-256: 32921abadbce5addbbc10b10a9e17a75ebc114d643223937bd87a6f98dda5bd0

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a significant number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a likely attempt to generate traffic or distribute further payloads. No scripts were extracted from this sample, limiting the analysis of direct malicious actions.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://photosbypi.com/uploads/1/3/1/3/131398204/131398204.html#circuitos+en+paralelo+ejercicios
- http://landscapedreaming.com/uploads/1/3/1/3/131381241/5403562.pdf
- http://houseofhairaccessories.com/uploads/1/3/0/5/130550960/6e0922e5bb62c.pdf
- http://domainesaintmichel-provence.com/uploads/1/3/0/4/130477152/7951823.pdf
- http://rotenier.com/uploads/1/3/1/4/131406507/3552355.pdf
- http://fundamentalsocceracademy.com/uploads/1/3/0/7/130775529/6410d79fb99.pdf
- http://djgarbin.com/uploads/1/3/0/7/130775542/wovevil_wopugufezekusop.pdf
- http://csportsafety.com/uploads/1/3/0/6/130605452/9021976.pdf
- http://ashaimanarts.com/uploads/1/3/0/6/130605168/1109590.pdf
- http://edentheband.net/uploads/1/3/0/8/130873952/815adb30bac1.pdf
- http://forestmossgardening.com/uploads/1/3/0/5/130540352/3264429.pdf
- http://nazirene.net/uploads/1/3/0/7/130739220/5dcc8d6.pdf
- http://dancephysique.org/uploads/1/3/0/4/130435509/5467934.pdf
- http://englishsynergy.com/uploads/1/3/0/6/130620919/nesipozarizalele.pdf
- http://bethgrahamart.com/uploads/1/3/0/7/130739766/gurat_xekisimep_joligoviwer.pdf
- http://auntiemimisfarmhousekitchen.com/uploads/1/3/0/7/130776027/wumuratenulegiza.pdf
- http://www.true9accessories.com/uploads/1/3/1/4/131438278/wexoliponupofitimus.pdf
- http://legacycreekgsmd.com/uploads/1/3/0/6/130604688/tofalusoge.pdf
- http://msgracieberling.com/uploads/1/3/0/5/130551586/pobuwefikaxisuj_nobanej_tilil_farogubopukubeb.pdf
- http://pfslife.com/uploads/1/3/0/5/130590550/68beeadc9268.pdf
- http://margaretmidwood.com/uploads/1/3/0/8/130873953/b9c4dbdc.pdf
- http://drbirthphotography.com/uploads/1/3/0/6/130604456/1fb264af400e.pdf
- http://publicassistconsulting.com/uploads/1/3/0/9/130969488/rubidukiwaf.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006f00.bin` `3ba1820700b782c4dbf7c8551c629cd011235e0db0a01de45a40b7a53076076f`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6F00	7580 bytes
`font_01_sfnt_off00008b56.bin` `cf5e934e27da8c68fa523f59cb9b8d72b26bdbf3c356e59667281e7289f065e0`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8B56	3088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.