PDF malware analysis — malicious · 479ee34120a7e6da

MALICIOUS

PDF

55.9 KB Created: 2020-03-28 11:43:32 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 6f74f991348baf6914b3fa8b16c03bf8 SHA-1: 7dcd898c0a06cf969e4d1cb4e546594c795d3b12 SHA-256: 479ee34120a7e6da39f94a60d088dcc0cf8762e2d0514c5d67c3659cb8ea1b49

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains text related to movies and TV shows, suggesting a lure to disguise the link farm's true purpose. The primary intent appears to be directing users to a large collection of external URLs, likely for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://villageoaksofroundrock.com/uploads/1/3/0/6/130639653/130639653.html#movies+or+tv+shows+about+greek+mythology
- http://whythedogdied.com/uploads/1/3/0/2/130272432/razit.pdf
- http://thedesignerswife.com/uploads/1/3/0/6/130639282/jezunujekiwabiga.pdf
- http://faithsherrill.com/uploads/1/3/0/7/130776715/xofimuf.pdf
- http://spartanburgfamilylawyer.com/uploads/1/3/0/5/130588811/zopofuvetusasof.pdf
- http://www.mysparegarden.com/uploads/1/3/0/7/130740363/lesivabofoj_puxuliravori.pdf
- http://wojimbo.com/uploads/1/3/0/5/130590403/lekijitikarunag-natisesidado-batufisesapadev.pdf
- http://xplorcolombia.com/uploads/1/3/0/5/130590205/71fbcacfb5ef01.pdf
- http://deeprootsmountainrevival.com/uploads/1/3/0/2/130288444/21f817bb.pdf
- http://dominiquejoy.com/uploads/1/3/0/6/130640078/raruwiwofogopuz-xiwabeminifi.pdf
- http://galwaygallery.biz/uploads/1/3/0/9/130969372/pekigefiwenubomo.pdf
- http://tvrretreats.com/uploads/1/3/0/5/130588559/kirixejiwulojivoren.pdf
- http://pearljin.org/uploads/1/3/0/5/130588839/4e56a59bb66207.pdf
- http://nationalcrossday.com/uploads/1/3/0/3/130313089/8433137.pdf
- http://rotoradio.net/uploads/1/3/0/6/130620290/valija-patepemiwixafi-zodudege.pdf
- http://lobbyingandethics.com/uploads/1/3/0/4/130488759/a146727a53d51f.pdf
- http://show2web.com/uploads/1/3/0/5/130551399/714a9e8737ad0f4.pdf
- http://rischiocentrifuga.com/uploads/1/3/0/6/130639318/914d31c.pdf
- http://www.krunchforacure.com/uploads/1/3/0/5/130539940/e5be7.pdf
- http://naiveapparel.com/uploads/1/3/0/4/130436037/pisatem-ritisolubabuwod-dominakudi-wemidew.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00008d3a.bin` `b361d9d10b6294b57b59a53e6eaf45f63a69507e863e2db29dc3f896bd3dd813`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8D3A	11648 bytes
`font_01_sfnt_off0000b31c.bin` `83d89f79375f7f339e88070a8779324ce221c94923bff415e388e162fbc46cfe`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB31C	2604 bytes
`font_02_sfnt_off0000bc4f.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xBC4F	16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.