PDF malware analysis — malicious · 36e36a50407d0cee

MALICIOUS

PDF

57.5 KB Created: 2020-04-02 03:30:31 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 7aa5c8b9a8bb51fb02877cf4e7f60b65 SHA-1: c5244bd029301e4b96b058abf250b0bb081f606a SHA-256: 36e36a50407d0cee1bda8330fd20fc2229cb7b7a15d7602f2a0c6a0644a6f37c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1598 Gather Victim Identity Information T1204 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to distribute further malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, pointing to numerous PDF files hosted across various domains. The document body itself contains seemingly innocuous text related to boiler startup procedures, but this is likely a lure to disguise the malicious intent of the link farm.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://katiaponomareva.com/uploads/1/3/0/8/130814010/130814010.html#thermax+cfbc+boiler+startup+procedure
- http://bb3solutions.com/uploads/1/3/0/5/130539095/41267.pdf
- http://cheappromcars.uk/uploads/1/3/0/7/130740165/fazixenevarexa.pdf
- http://dreamsportspage.com/uploads/1/3/0/2/130291531/7fbaa2.pdf
- http://labradorablelove.com/uploads/1/3/0/5/130540282/favurog_vufazivilafet_zizub.pdf
- http://bookoobooks.org/uploads/1/3/0/7/130775592/5914012.pdf
- http://outliercreative.studio/uploads/1/3/0/5/130589227/vixizofukasuvozepure.pdf
- http://shoppify.me/uploads/1/3/0/7/130738708/niluzososu_menokiboma_razewe_ratodadulafu.pdf
- http://infinitespin.com/uploads/1/3/0/8/130814623/7825939.pdf
- http://heartcentreawareness.com/uploads/1/3/0/8/130874136/6695740.pdf
- http://mymountainstories.com/uploads/1/3/0/5/130551671/7e5d3fe5e483a3.pdf
- http://oliverfcs.com/uploads/1/3/0/2/130291390/2922147.pdf
- http://heatheradle.com/uploads/1/3/0/6/130639561/wuvanil_gobapupabuxepod.pdf
- http://greeniequeenie.com/uploads/1/3/1/1/131163772/tokenemud.pdf
- http://theladdsgroup.com/uploads/1/3/0/5/130589128/0757b.pdf
- http://luxoperon.com/uploads/1/3/0/6/130639531/dovabutigixekibudi.pdf
- http://therelentlesspursuit.us/uploads/1/3/1/4/131438309/vemozidevar.pdf
- http://tuarbol.net/uploads/1/3/0/7/130776111/14fd03d653f.pdf
- http://mail.beeriodictour.com/uploads/1/3/1/4/131454215/rojipifakelu.pdf
- http://homevisitcomputers.com/uploads/1/3/0/7/130775972/sunalenujotunazil.pdf
- http://craftypainterqueen.com/uploads/1/3/0/8/130814248/0d8f5ad13fb137.pdf
- http://utahbouncehouse.com/uploads/1/3/1/4/131482850/2644813.pdf
- http://saverioesara.com/uploads/1/3/0/3/130379113/doradu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000093c4.bin` `74fee3286319bdc3bee4b7f2e182ae1861c7c7158d103346de9eec5435f5b9dc`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x93C4	8676 bytes
`font_01_sfnt_off0000b4b0.bin` `e994c37e265fc30300f0d31b64f798eef6a3bc92be56f6e9309aff2981ac337c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB4B0	12376 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.