PDF malware analysis — malicious · a35a3594249e3ac6

MALICIOUS

PDF

31.9 KB Created: 2020-03-09 07:37:57 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 52c1578c25a8a5fd474d09e877e1b993 SHA-1: c75838e649385389e351ccb13348756d9c675121 SHA-256: a35a3594249e3ac659efa4204b4f1f68e7a5f88497bcd481e279c758cd36cac6

82 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF is an image-only document designed as a lure, containing a clickable link that directs to an external URL. This technique is commonly used for phishing or to initiate malware downloads. The PDF also contains a large number of external links, suggesting a link farm for SEO manipulation or to distribute malicious content across multiple domains. No scripts were extracted from this sample.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 31 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://adsl-63-204-18-29.benefitplans.org/uploads/1/3/0/7/130775997/130775997.html#trane+rtac+300+chiller+manual
- http://wesustainshelby.com/uploads/1/3/0/2/130292179/7256176.pdf
- http://everysinglequestion.com/uploads/1/3/0/2/130289796/xigudivona_gufagukeziju_fifeturejajug_jamupusibipi.pdf
- http://rickli-art-schweiz.com/uploads/1/3/0/6/130604741/2963703.pdf
- http://sophiacatalina.info/uploads/1/3/0/6/130639438/xinipijimezuko.pdf
- http://abgymcr.com/uploads/1/3/0/5/130547450/3353752.pdf
- http://visionnetworks.co.nz/uploads/1/3/0/4/130476516/829613.pdf
- http://charlottemulcare.co.uk/uploads/1/3/0/2/130270763/bb521eff931b6c0.pdf
- http://trevornewtonartist.com/uploads/1/3/0/6/130604467/bimed-sotova.pdf
- http://lippincotts.net/uploads/1/3/0/4/130491947/firasepako.pdf
- http://highcontents.com/uploads/1/3/0/7/130776474/duxof-zejuzaped-wifebinot-kefebikan.pdf
- http://panelinha.net/uploads/1/3/0/6/130620268/nasimu.pdf
- http://ravenheim.net/uploads/1/3/0/4/130493389/6354109.pdf
- http://meyerforcongress.com/uploads/1/3/0/6/130605182/dadopaxilimedo.pdf
- http://notldthemusical.net/uploads/1/3/0/6/130604014/lewemagikokejaz.pdf
- http://ya-amar.com/uploads/1/3/0/5/130589145/filuxajekew-pigajewar.pdf
- http://collaborativeservice.com/uploads/1/3/0/7/130775014/c445daac41f04.pdf
- http://amychurmt.com/uploads/1/3/0/6/130621435/pixexavatafotapanomu.pdf
- http://bossmomplus.com/uploads/1/3/0/6/130621426/juzasamadapimefiv.pdf
- http://miss-diva.com/uploads/1/3/0/5/130589123/f8dc4e2ed091d2.pdf
- http://serenityvalley.farm/uploads/1/3/0/3/130323656/wojoxinuloj.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00005d09.bin` `7f972d703bac04817bc8afff526825b351f0df26213a3283c446d37284a877df`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5D09	5184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.