PDF malware analysis — malicious · 8f1b0c06b5d08650

MALICIOUS

PDF

42.1 KB Created: 2020-03-22 14:49:25 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 69211c3e97b02ddd6f3b6647a6ddfb71 SHA-1: d69b0c5c73b5f447a2e24705b530d0ec65999ea4 SHA-256: 8f1b0c06b5d08650b248e890881b024e3bb665425b6cd0163b28e62700af182c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The document body, though partially corrupted, contains the phrase 'Peso ideal para hombres por edad y estatura' which suggests a lure. The primary purpose appears to be directing users to a network of linked PDF documents hosted on various domains, likely for SEO spam or to distribute further malicious content.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://lula.site/uploads/1/3/0/6/130639578/130639578.html#peso+ideal+para+hombres+por+edad+y+estatura
- http://dwight-womack.com/uploads/1/3/0/6/130603894/7927958.pdf
- http://hapihawaii.net/uploads/1/3/0/8/130814515/mafupemi.pdf
- http://www.pcmsolutions.org/uploads/1/3/0/6/130639743/mogetewaxo.pdf
- http://i-am-angelica.com/uploads/1/3/0/6/130639887/21203aaa8cc.pdf
- http://drivenlife.net/uploads/1/3/0/4/130483795/lebewanozofe-fejukodi-xubonad.pdf
- http://lennygartstudios.com/uploads/1/3/0/2/130287394/zafudadarovu_tumimigetu_pawano_gapokelol.pdf
- http://dexandra40.com/uploads/1/3/0/5/130590219/4154475.pdf
- http://sunshincn.com/uploads/1/3/0/6/130622092/nutenukaja.pdf
- http://anarchydieseltuning.net/uploads/1/3/0/6/130639091/716038.pdf
- http://endoftheroad-ak.com/uploads/1/3/0/5/130540664/f79a7a8.pdf
- http://www.voxtw.com/uploads/1/3/0/4/130477541/2823254.pdf
- http://vertexsyntheticturfsupply.com/uploads/1/3/0/5/130547450/vakokobolo-zatumubifokazi-firan.pdf
- http://kroxi.sk/uploads/1/3/0/6/130621542/0821b7.pdf
- http://www.nt-multimedia.com/uploads/1/3/0/6/130603892/5432775.pdf
- http://www.hope-post.com/uploads/1/3/0/6/130604935/segasizoxe.pdf
- http://freshjuicejoint.com/uploads/1/3/0/6/130604522/253669.pdf
- http://mail.zandq.com/uploads/1/3/0/2/130287529/liluzezisuzevax.pdf
- http://www.curiousproducts.net/uploads/1/3/0/3/130323260/todibefemejakorip.pdf
- http://mikewhitmore.com/uploads/1/3/0/7/130775376/sevilibitimakeg-gawegekuj-mubupatu.pdf
- http://yassinebenfatah.com/uploads/1/3/0/5/130550956/ralevuneluzavo.pdf
- http://fpucdn.com/uploads/1/3/0/7/130776886/8593977.pdf
- http://savagesounds.net/uploads/1/3/0/8/130873995/6302a96a3e2062f.pdf
- http://condex99.club/uploads/1/3/0/6/130620521/vilabem.pdf
- http://www.theforagedfern.com/uploads/1/3/0/5/130540293/5343d4c0e0.pdf
- http://lienyuyu.com/uploads/1/3/0/2/130287229/kikaxuxufupepet.pdf
- http://lienyuyu.com/uplo
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000791e.bin` `3ef7844eb4daa148eb19fb951bff93a74b3f65eb1d95076783860d9eef3693cf`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x791E	8556 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.