PDF malware analysis — malicious · ac01aac4b8d86daf

MALICIOUS

PDF

77.7 KB Created: 2020-03-11 13:01:34 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 43824699efa907ad9569b3eae706b149 SHA-1: ee8ba8f0bf190ef8b2b15b6d1e09c1580574fb03 SHA-256: ac01aac4b8d86dafefd31f6c8cdab3b402e2abec2d5bee6ac97b6cea45cfbb41

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a significant number of external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. These links point to various domains, many of which appear to be part of a link farm designed to manipulate search engine results. The primary embedded URL, 'http://hailifangyulechengxianlu.br3h.com/uploads/1/3/0/6/130604088/130604088.html#saccular+abdominal+aortic+aneurysm+rupture+risk', suggests a lure related to health information, likely to redirect users to malicious content or phishing pages.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://hailifangyulechengxianlu.br3h.com/uploads/1/3/0/6/130604088/130604088.html#saccular+abdominal+aortic+aneurysm+rupture+risk
- http://cekyakonsoloslugu.net/uploads/1/3/0/5/130588403/dofuri_milisujulosa_kotigifofim_kitugo.pdf
- http://thendralgardens.com/uploads/1/3/0/2/130288673/4798801.pdf
- http://tor.money/uploads/1/3/0/7/130739318/a3c142.pdf
- http://amywoodbridge.com/uploads/1/3/0/3/130313307/d680a922.pdf
- http://elisabeth-anderson.com/uploads/1/3/0/5/130551671/c0ac07ba8c59.pdf
- http://www.bbcaudio.org/uploads/1/3/0/6/130620833/222d9ead.pdf
- http://be-wellaccessories.ca/uploads/1/3/0/8/130873995/kumedom.pdf
- http://my365tutors.net/uploads/1/3/0/5/130551090/vuwevotutono.pdf
- http://www.readersenvy.com/uploads/1/3/0/7/130739021/2564357.pdf
- http://narayanahotelandresidences.com/uploads/1/3/0/4/130435895/molokowuviwex.pdf
- http://cetai.org/uploads/1/3/0/6/130603803/kodijarizugejel.pdf
- http://joinloveandresistance.com/uploads/1/3/0/6/130620234/farudugebonamo_sedijo_xulusif.pdf
- http://drvdv.com/uploads/1/3/0/5/130588656/vomalupifusebabuxak.pdf
- http://blackmomsstaylifted.com/uploads/1/3/0/3/130323630/rofoxofulegasu.pdf
- http://derryfieldrepertorytheatre.org/uploads/1/3/0/5/130543941/wumuzusex-momabonafa-tarupesurar.pdf
- http://www.cateringhayet.nl/uploads/1/3/0/6/130605229/gogape-vijib-tokupudafob-jesiwomixure.pdf
- http://texanhomestudy.com/uploads/1/3/0/5/130544063/78b6c70189.pdf
- http://dentistinwoodburn.com/uploads/1/3/0/7/130739139/malasulerozaboxev.pdf
- http://cook-edu5.com/uploads/1/3/0/6/130620325/7262046.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ddb7.bin` `c0cd5a6bc6e0d8efeb3de59c18865d53a6773adef9db1e989313a109e89a9026`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xDDB7	10880 bytes
`font_01_sfnt_off0001045d.bin` `68b3d8e18803dacee951ee2df14bbe8dda7c3b5753ec9baa6ccbcb58c38a5fc9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1045D	4108 bytes
`font_02_sfnt_off0001122c.bin` `6db6d9634b9937aa3169e45592670fe9753bced9edc690faa32395a665744885`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1122C	16204 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.