PDF malware analysis — malicious · 53331fbe9d7efc42

MALICIOUS

PDF

34.2 KB Created: 2020-03-13 03:38:03 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 9a2bf71006a311e52c5a245476e2110b SHA-1: b25fbd1d3a38571546a26e5b1402c2fcafbcc47e SHA-256: 53331fbe9d7efc4206a4dd517d439019a414a0ee8032dc74a66c6969ae7e865b

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The document body, though heavily obfuscated, contains a URL that is also present in the heuristics. This suggests the primary function of this PDF is to act as a link farm, potentially for SEO manipulation or to distribute further malicious content via the linked PDFs.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://wangshangyingqian.br3h.com/uploads/1/3/0/2/130287493/130287493.html#ayyappa+swamy+songs+telugu+movie
- http://pierrepaulbitton.net/uploads/1/3/0/5/130590618/bf7602c3f.pdf
- http://www.allisonevansphd.com/uploads/1/3/0/8/130873829/d4f290.pdf
- http://www.vion.devauzet.de/uploads/1/3/0/3/130379798/jatedupokotopitat.pdf
- http://www.mindsetmakeover.site/uploads/1/3/0/7/130740128/wisexig.pdf
- http://mygaymagic.com/uploads/1/3/0/5/130551245/sukap_noxurowivimo.pdf
- http://covenantfellowshipchurches.org/uploads/1/3/0/4/130476294/pegikumanumotediteda.pdf
- http://caraveladanbury.com/uploads/1/3/0/5/130539517/d5861ad7614c9.pdf
- http://gillislawgroupmd.com/uploads/1/3/0/9/130969704/966c85.pdf
- http://thendralgardens.com/uploads/1/3/0/2/130272102/1235733.pdf
- http://www.baarleproeft.com/uploads/1/3/0/9/130969858/labiluzaziw.pdf
- http://digitalmeters.co.uk/uploads/1/3/0/5/130543261/watudimobobob.pdf
- http://haroldhopkinson.com/uploads/1/3/0/6/130604757/mabati.pdf
- http://mail.ironcastlemarketing.com/uploads/1/3/0/4/130483329/wojofituxew-dukuju-zexetalogovo-xekijavejajuver.pdf
- http://whatthepeoplethink.co.uk/uploads/1/3/0/7/130775199/kimofevo.pdf
- http://calgaryruralmedicine.ca/uploads/1/3/0/6/130604568/1608526.pdf
- http://jandwcleaningteam.net/uploads/1/3/0/9/130969235/jimakavorowipud.pdf
- http://thesprinklerpro.com/uploads/1/3/0/5/130590567/sovoguxavodu.pdf
- http://davidjosephryan.com/uploads/1/3/0/8/130874121/b10bf62e6fb.pdf
- http://www.classiccars.global/uploads/1/3/0/5/130551362/tetoxurepiko_lavexisefazen_vosazexus.pdf
- http://delmontesupport.com/uploads/1/3/0/7/130739495/jobiranuzebunazixu.pdf
- http://educationforsustainableliving.ca/uploads/1/3/0/7/130739053/jizusetavasun.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d87.bin` `f56f72965cc666b5a2d569aaba108dee9abf5da8c409ccfb73514277ad3bd6e4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D87	7592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.