PDF malware analysis — malicious · 5690c6d049a58b5a

MALICIOUS

PDF

38.6 KB Created: 2020-05-14 20:30:52 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 624da38b0ef3cd1e286ce119a07aa63b SHA-1: 91f72f6d4634f3dd6b4284947c422c53bc8189fc SHA-256: 5690c6d049a58b5ac77eeda2e8206b2aeba52c1fdc982bbfd1e954ae2cf65d9f

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO poisoning to drive traffic to malicious sites. The document body itself is heavily obfuscated but contains references to exam forms and dates, suggesting a lure. The primary heuristic indicates a PDF link farm, with many URLs pointing to PDF files hosted on various domains.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://kindkvist.com/uploads/1/3/1/1/131163834/131163834.html#cbse+improvement+exam+form+filling+date
- http://mosaichappy.com/uploads/1/3/0/8/130874591/2996888.pdf
- http://thelashboratory.com/uploads/1/3/1/3/131384227/8050303.pdf
- http://customcastsystems.com/uploads/1/3/0/3/130323295/juvir.pdf
- http://childrensworkforceconsultancy.com/uploads/1/3/0/7/130739150/324a4617e0c555.pdf
- http://iuacademy.com/uploads/1/3/0/6/130604185/pedinifures-fosewagud-buvoxifo-nolukubuko.pdf
- http://simpleedesign.com/uploads/1/3/0/7/130740497/nizafi.pdf
- http://cuffedbyjewels.com/uploads/1/3/0/6/130603676/dobomuwitodivi.pdf
- http://ctransformhealth.com/uploads/1/3/0/8/130874113/3211573.pdf
- http://legalpt.com/uploads/1/3/1/4/131406480/b3e7e2a4b.pdf
- http://carolwatsonmiller.com/uploads/1/3/1/8/131856119/fuvamaxikifu-tolata-sagisuf.pdf
- http://seikerinternational.com/uploads/1/3/1/6/131637178/2a369b83ee6de5.pdf
- http://lubbockfloresflowers.com/uploads/1/3/0/9/130969686/7864921.pdf
- http://pattenacademy.net/uploads/1/3/0/4/130488114/dubib.pdf
- http://resurrectionmusem.com/uploads/1/3/1/4/131407849/pajuwobogibudul.pdf
- http://richardpeterharrison.com/uploads/1/3/1/4/131454771/4fec4f39634.pdf
- http://simeonspeaks.com/uploads/1/3/0/6/130605399/bogaxuwevudusim.pdf
- http://bandbcleaningservices.com/uploads/1/3/0/3/130313089/0624cd264bd2f8f.pdf
- http://omeraziz.com/uploads/1/3/0/3/130379163/8f226195273c.pdf
- http://defenderpolicesupply.net/uploads/1/3/0/4/130483215/923017.pdf
- http://thejohnstonbuilding.com/uploads/1/3/0/6/130639980/gudagunif-gumefe-kunopanubere-kojuxaru.pdf
- http://thebossbabenetwork.com/uploads/1/3/0/7/130775704/3586166.pdf
- http://collaborate.care/uploads/1/3/0/4/130489228/rodapimerafuw.pdf
- http://steamplayground.org/uploads/1/3/0/5/130543462/2caff6467ed8b5.pdf
- http://dogtownemarket.com/uploads/1/3/0/4/130476006/7ede1be12f000b6.pdf
- http://tweste.com/uploads/1/3/0/3/130313170/2202489.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000069d6.bin` `f34b95fb4f02558b281b5a2fe427ed90a8d4059b5b785b87aacaa660d9df915a`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x69D6	10744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.