PDF malware analysis — malicious · 3a4dde683c2629f7

MALICIOUS

PDF

36.9 KB Created: 2020-05-17 01:00:46 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 644fd62dfa00cc54ef85830112a1bc64 SHA-1: 9086a347a4e3f47c9924d3b21764ed8313cb814d SHA-256: 3a4dde683c2629f71f88dcdf5941509ef0c450489c54d497647231eee1864ae2

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to various PDF documents on different domains. This pattern is indicative of a link farm or a distribution mechanism for malicious content. The heuristic 'PDF_SEO_LINK_FARM' strongly suggests this intent. No scripts were extracted, and the document body is largely obfuscated, but the sheer volume of external links is the primary indicator of malicious activity.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://geevini.net/uploads/1/3/0/6/130604939/130604939.html#proses+metabolisme+karbohidrat+pdf
- http://allhallowscanine.com/uploads/1/3/1/0/131070723/5890704.pdf
- http://milegion-legacyrun.org/uploads/1/3/0/6/130621116/wudoguzidozejas.pdf
- http://1sttimebuyerdeposit.com/uploads/1/3/0/4/130475877/7912877.pdf
- http://tremainefoundation.net/uploads/1/3/0/3/130323212/xexinibum.pdf
- http://ryleeloucharity.com/uploads/1/3/0/8/130874422/tukolura.pdf
- http://junli2483.com/uploads/1/3/1/4/131408159/fobonololumupe_tulidimegip_momuzunigakux_padowa.pdf
- http://timsmythephotography.com/uploads/1/3/0/7/130739480/duxode.pdf
- http://dreamsandhelp.com/uploads/1/3/1/8/131856108/c865f9574f.pdf
- http://lovelyuntamedrituals.com/uploads/1/3/0/4/130489371/3548577.pdf
- http://avoiceforthelost.com/uploads/1/3/0/8/130874615/4851694.pdf
- http://ourvotenow.org/uploads/1/3/0/9/130969865/pebipilip_medoguvo_nuravomukitum.pdf
- http://roxannesloan.com/uploads/1/3/0/6/130639641/5694408.pdf
- http://itsdadoll.shop/uploads/1/3/1/3/131384127/fae6375bff87.pdf
- http://gabbard-cornell.com/uploads/1/3/0/4/130488414/wivikezapelaj.pdf
- http://levelsoflove.org/uploads/1/3/0/2/130272415/lopikipitupomoduz.pdf
- http://pl-eshop.me/uploads/1/3/0/6/130604562/21628dff20.pdf
- http://fullyinvolvedleather.com/uploads/1/3/1/3/131383586/5497005.pdf
- http://bsquarellc.com/uploads/1/3/0/4/130435848/edb62d578.pdf
- http://roylaws.com/uploads/1/3/1/3/131380786/ginabozejuworakofonu.pdf
- http://ivybrookmppta.com/uploads/1/3/0/3/130323445/soxarawavasolij.pdf
- http://westcreekfinancial.com/uploads/1/3/0/5/130546000/4b506cf.pdf
- http://riort.be/uploads/1/3/0/6/130639709/kebugubovupuzej.pdf
- http://abetterrentalproperty.com/uploads/1/3/0/6/130620430/1998425.pdf
- http://cesun2018.org/uploads/1/3/0/3/130313307/9220934.pdf
- http://christ4sure.org/uploads/1/3/1/0/131070847/kipediso.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00006606.bin` `6dab92adb7948b3e75d06f0130c5efdf63d5e46f6e470fe609462843e6ee00e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x6606	9780 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.