PDF static analysis report

Static analysis result for SHA-256 53b14769fa102c5a…

SUSPICIOUS

PDF

83.4 KB Created: 2016-12-26 18:13:16 +08:00 First seen: 2018-10-07
MD5: df88f7df9abbbc18dc64c6746b434afc SHA-1: 422bad89266294a58e9d2f3a0b78560c73fcfdde SHA-256: 53b14769fa102c5aada1312e5ad650a744366be9b0fadd0c37cbfdcb3fbad623
34 Risk Score

Machine Learning

  • Nyx PDF Classifier clean score 0.0405

Heuristics 3

  • PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM
    PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dubaipropertyrentals.net/organizefree/carrydetermine.php/tlP_krPYlxuecG16217807o.pdf PDF link annotation
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/JGPkxGJfhsxGJ_JdmleakrP_Yhxl16217664vf.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/fzxoowPQwYJrJhkdQxnGranrvtz_z16217639rhPY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xoeukazGGkmGxttGtovshwYi_a16217519szth.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/Q_aruz_YfncdcxuhxrrburP16217249Gr.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/iYYssmfk_ouJhxts_uYwPhbhbsnP16218036ko.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xf_owlcknfJukPvccYmlw_ncono16217794ai.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/aYJzuuzdbluvbs16217899P.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/uQwdzuv16217909tQ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/aJ_kdrchbz16217708avad.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/dtPQG_adGeskleJe16217472Yx.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/dY_cnrb_lYobam_Gvob16217869weht.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/JxneQfiPGdbatecPhohbtbrwtJP16217836lruQ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/kdtJzstvwvJw16217286i.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/lJPJniwsbmQioP16217489ax.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/bbQv_J_mhoovkzdu16218169Qox.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/rtieQ16217809Y.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/rJ_ixabGmYiaizzx16217243_.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/svlsxiQJzo16217289d.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/uimzJri16218105zzY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/mQuPcbnkrvzGxkedkJcGvofvaumnmn16217671z.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/cPwfaidYGaJhQhmdkzez16217948rJ.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/PJkJsrdd16217917n_b.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/tkemumkP_adGnrrwJfiwlz16217769c_nY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wnbtdzQfmkiYsc_16217617Yrc.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/midzYiadbxzo16217597v.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/oebzdkQb_Qodze_QkfGxcwmsYba16217191nfmo.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/aYPxeQewucJmwzhPhm_zGfsrPcfs16217224lssn.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/mmcotzalllfQuvPcw16217864mrza.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/P_QzhPwlfe16217428ix.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wGwvvoJ16217655Jd.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/lfhsvisouoieo16217429f.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/aPiefxtGtdkosazkdYe16217439tc.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/horxfvkPdduaos16217466PuYn.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_rcPif16217941Jr.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/sxliJha_Pwo16217487wx.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_tdQdshwfnkhhoYmueYmtuawzc16217992meG.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/JGodrhtuuQfGfi_fssb16218066el.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/YGdf_fo16218162Pz_l.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/fQGYvmo16217280bG__.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/iGzYodabkPxtwncthYzhloevcwvblP16217556ta.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/hutodmesPdGuo16217851mrs.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vhnGwlmbircvanb_iwuialhshamwbP16217540o.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/szYwbfttuakscYheYh_JlcotufQn16217430cY.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wconhxkYGtJx16217426s.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/nxufrwxonchfzfxtvveaktlb16217311ahtu.pdfIn PDF document text
    • http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xsfzivPGkr16218039zle.pdfIn PDF document text
    • http://www.partyservicedaro.nl/armboard/YvwdlGshcicQhzenQYJkzw16203117t.pdfIn PDF document text
    • http://www.partyservicedaro.nl/armboard/axYhlnPhkdexitkxo_ssflPJzc16194507tPn.pdfIn PDF document text
    • http://www.partyservicedaro.nl/armboard/cdbliznkPYehxQsvYxJJP16165858_z.pdfIn PDF document text
    +20 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off0000a688.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0xA688 20244 bytes
SHA-256: e23f5aab46115cbb523a51cdce052f239a894a9465aca76390610c56ef440ad5
font_01_sfnt_off0000dd57.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDD57 19964 bytes
SHA-256: 5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8
font_02_sfnt_off00011310.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11310 20828 bytes
SHA-256: 66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1