MALICIOUS
102
Risk Score
Malware Insights
MITRE ATT&CK
T1059.001 PowerShell
T1566.002 Spearphishing Attachment
The PDF contains a large number of external links, many pointing to PDF files hosted on unrelated domains, suggesting a link farm or SEO poisoning tactic. One heuristic specifically identified a 'Password-protected archive handoff' lure, indicating the document likely provides a password and directs the user to download an encrypted archive. This is a common technique to evade gateway security by hiding malicious content within a password-protected file. The presence of numerous external URLs and the password lure strongly suggest a malicious intent to deliver a payload.
Heuristics 4
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LUREDocument gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://74-123-72-89.mgwnet.com/uploads/1/3/0/9/130969011/130969011.html#adobe+animate+cc+2017+bagas31
- http://e1church.com/uploads/1/3/0/5/130543148/sewak-zobaratiwaxes-latizuluf.pdf
- http://www.womenonpar.com/uploads/1/3/0/6/130620366/fedojavorujadedeka.pdf
- http://skidayz.co/uploads/1/3/0/3/130313005/kosivopagimasowet.pdf
- http://ns2.onlineloan-payday.org/uploads/1/3/0/6/130639155/zuduxujeloniduk.pdf
- http://collegewritingsupport.com/uploads/1/3/0/5/130541023/7857983.pdf
- http://74-123-72-18.mgwnet.com/uploads/1/3/0/8/130814172/jowemidumadi-kanepevelikiz.pdf
- http://tenzon.org/uploads/1/3/0/6/130621444/f9a8661c.pdf
- http://botmidasteam.com/uploads/1/3/0/7/130775025/gilat.pdf
- http://www.lanzaroteboatexcursions.com/uploads/1/3/1/0/131070574/dekar.pdf
- http://wikademia.org/uploads/1/3/0/6/130621215/9139471.pdf
- http://jiaxuanzhang.org/uploads/1/3/0/3/130312919/6267698.pdf
- http://glamodo.org/uploads/1/3/0/4/130479171/mezafojatokelox.pdf
- http://northtexasstrings.com/uploads/1/3/0/4/130488345/duvebinabetegabilu.pdf
- http://reboundat.com/uploads/1/3/0/7/130738720/7fcd2b.pdf
- http://expressrelocators.com/uploads/1/3/0/8/130814782/bfce416.pdf
- http://www.livingbylucy.com/uploads/1/3/0/4/130483114/pudusexekatolug-toras-fefagixasox.pdf
- http://www.kenmcknight.com/uploads/1/3/0/3/130313178/tizabifuda.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 3
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00007ee6.binb41e331ff0ab228f0b29f3a56ee4923969c0f9b08c25ecf818f1af1b8fe2831b |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x7EE6 | 8072 bytes |
font_01_sfnt_off00009e31.bin158bba28c689c5a65a90bb407284eec9802fe203910a1cac654b20ea7a3ae50f |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x9E31 | 6540 bytes |
font_02_sfnt_off0000b368.bin779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xB368 | 16036 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.