PDF malware analysis — malicious · 38fcfe6f82b661cf

MALICIOUS

PDF

42.2 KB Created: 2020-05-16 17:48:53 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 824f2523e0b06a6c5b85699467ba34d2 SHA-1: 22c31c85c466ec6fe6e117ad4754d04cd5b0d45f SHA-256: 38fcfe6f82b661cf0ced70f77fb61720430ab9aec3cf7565335afb3e795c4e71

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many pointing to PDF files hosted on various domains. This indicates a link farm designed to trick users into downloading potentially malicious content. The presence of a deceptive download button further supports this malicious workflow. No scripts were extracted, limiting the ability to determine the exact payload.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://michaeldnolan.com/uploads/1/3/0/6/130603925/130603925.html#bamb+jatt+hd+video+song+free
- http://crowdrisediy.com/uploads/1/3/0/5/130541308/d6635db7c7c.pdf
- http://allheartcprtx.com/uploads/1/3/0/8/130814063/43a7ebeeff23e6b.pdf
- http://agro-spezial.com/uploads/1/3/0/4/130483761/73f8d065997cb.pdf
- http://freshstartservicesinc.com/uploads/1/3/0/2/130271153/6f2190d.pdf
- http://lookoutpets.com/uploads/1/3/0/2/130272415/pusatiwutoten.pdf
- http://hopetechnologies.net/uploads/1/3/1/4/131438468/2623130.pdf
- http://alanhubatka.com/uploads/1/3/0/6/130604885/6323562.pdf
- http://gotocampusa.com/uploads/1/3/0/6/130639347/3116282.pdf
- http://onsolvecoptampa.com/uploads/1/3/1/8/131859261/8068972.pdf
- http://lolitamoore.com/uploads/1/3/0/5/130540046/2248fb5b09266c.pdf
- http://sarahmathison.com/uploads/1/3/0/2/130270859/6008d9c.pdf
- http://selldchouse4cash.com/uploads/1/3/0/3/130324390/9821515.pdf
- http://loveblubags.com/uploads/1/3/0/5/130539287/5091374.pdf
- http://mokshaflowers.com/uploads/1/3/1/1/131163858/9742400.pdf
- http://allenhomestaging.com/uploads/1/3/0/8/130813646/3861611.pdf
- http://essentialwellnesscollective.org/uploads/1/3/0/3/130313167/nekajotoruk-vevubuxegorube-salit-sewadososu.pdf
- http://edwarddeleski.com/uploads/1/3/0/7/130776060/6267483.pdf
- http://westbrookwillow.com/uploads/1/3/0/6/130639812/d228609bc045.pdf
- http://gaddyhanit.net/uploads/1/3/0/4/130488698/8450503.pdf
- http://lsbol.org/uploads/1/3/0/5/130539735/xixib.pdf
- http://dscleaningservices.net/uploads/1/3/0/6/130604618/wakafutepewal.pdf
- http://onlychoiceconsult.com/uploads/1/3/1/3/131379940/3057494.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000674e.bin` `00d85587ac268c77c79c9ef0a6dc9c7058f649616d1a6ddb6280025400f4dd30`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x674E	5144 bytes
`font_01_sfnt_off0000790e.bin` `8ca340b4f4b0c865b9a4cc3040356d201aeb256ecee5dfbc15a6a01608d88099`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x790E	10512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.