PDF malware analysis — suspicious · 95bd87cba611cc43

SUSPICIOUS

PDF

86.5 KB Created: 2016-12-26 17:00:25 +08:00 First seen: 2018-10-07

MD5: b3b1a4a50f4fab689e45a5fd8e203be6 SHA-1: 7a23539005fb1c1bd896033a1b593062ba7d3bae SHA-256: 95bd87cba611cc43ee14ff09aac4f07c8b236f07bb4a55576dc9d41f2ef4c5c6

34 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.0405

Heuristics 3

PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM

PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/kdGar16217038ke.pdf PDF link annotation
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/wez16216609rivY.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/dtlkPtbudehJ16216474fGYt.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/wklhetGvJx16216742bx.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/GYbPJQkiuJtYsz_csnfl16216324iGu.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/daGrwQsJ16216819se.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nvo16216631a.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/QmsuwP_GusPsraPzofairnxhbxkk16217166cvec.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/sbmGP__dzafQtuwdirtzJmf16216220zs.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/YJeavik_aminfzx__hvdb16217114cY.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/bPcvhczuwkJJlhblnuc_kdfeknvn16216523Qiu.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ciPiivlwh16217082_.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/uGdcJihQhnJvzvtahle_xd_ftrnhw16216216P.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/czxhsGviiwvmw_dGkskcrkzlfv16216663ufv.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/wdnuvlvhbwczh_mf16216186nnzx.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/imkwkorQbsPcbkQJakth16216822nG.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/sYmennfw16216529k.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/amnQaJsPsml_oQhnk16216386Gkv.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/bessrciP16216500_lds.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/rvtwhkfckroaJP16216778o.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/_raY16217172ha.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nvodiPdovactbvtQYftJcQmGetw_c16216396iGbu.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/_zwzPv16216203n.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/maQkvwPsJvut16216188wfh.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/eGcdzixhtwnJwkos_uQhY_iJloeu16217182ihtd.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nYlbwliQwodewcn_hPzcGYiJlYstr16216730uo.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ecPPifmlislrwkcP16216617azw.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/QQinfxsvcfsadm16216400n.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ahehkvmP16216550_zG.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/loizua_YbiePczz16216760v.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/auocbzwauQQbYiszthiPvkJ_c16217006fl.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/bk_ruPxlcsiaQoraGaafsbww_GrihQ16216246fle.pdfIn PDF document text
- http://www.goldae.ch/img/lmYJ15615359v.pdfIn PDF document text
- http://www.corsoanatocismousura.it/index.php/view/ivPbkwhbYx_15486615if_G.pdfIn PDF document text
- http://www.harmerandsonsplumbing.com/cdeafdvztwYzhkaniGc8239642alxa.pdfIn PDF document text
- http://www.citrusheightsplumbing.net/tmp/exakechrvP_eJnmszwxhYJiPwlzkfe16043454zs.pdfIn PDF document text
- http://trinketsltd.com/linda/zzawoeevniebrzhvJtm13082262s.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/iYvlGdlrPnGnnaPt16216653d.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/xGn16217059f.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/GabetxiYhczwJa16216858ucsd.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/boJivknxvsdYvtz_16216401b.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/YezmGhQt_xebYkJlcbe16216502f.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/hYzQoucfccGhd16216682GQ.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/ncuhQeoudwvda16217028uehv.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/YQQPeGv_wPiGwaoawh16216334o.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/rlQv_16216912o.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/bzQhtmPGuwrucbzntamao_Ga_16216933P.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/aofxmxedGktk16216990aak.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/kPbl_16216578_zo.pdfIn PDF document text
- http://dubaipropertyrentals.net/departmentabove/departmentcarry.php/nnerJhkGmwmPmtYntbkn_lQwbzbxai16216882a.pdfIn PDF document text
+25 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_004_off0000b379.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xB379	19856 bytes
SHA-256: `a930245e90be17a336a7679d31e9d416ddec66c65020bec75b59b2e2bfc19120`
`font_01_sfnt_off0000e90b.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE90B	19964 bytes
SHA-256: `5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8`
`font_02_sfnt_off00011ecc.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x11ECC	20828 bytes
SHA-256: `66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1`

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Machine Learning

Heuristics 3

Related samples 8

Extracted artifacts 3