PDF malware analysis — malicious · b84641ef2ca35eda

MALICIOUS

PDF

58.3 KB Created: 2020-04-01 16:48:48 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 59134d68b41a442b8925134cc94f9a47 SHA-1: b5182331c5b3366c2922685ad6cd6986cfce20c7 SHA-256: b84641ef2ca35eda56da8beb4ab75b617e0f9a9ac418822ff18bc7ccb7a925ad

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The primary purpose appears to be directing users to a vast network of websites, likely for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://urbanvertical.ca/uploads/1/3/1/4/131409822/131409822.html#can+i+teach+myself+programming+and+get+a+job
- http://thebao.house/uploads/1/3/0/8/130813409/xanefexudugej.pdf
- http://ukm-hq.com/uploads/1/3/0/4/130488831/xitaj_wolix.pdf
- http://gettingtesty.net/uploads/1/3/0/3/130313577/9043248.pdf
- http://pmhomerenovation.org/uploads/1/3/1/4/131438067/5879010.pdf
- http://jaimesilversteinyoga.com/uploads/1/3/1/1/131163684/566b3384.pdf
- http://drmeghandvm.com/uploads/1/3/0/3/130313307/terefu_pidiziti.pdf
- http://twodiamondfit.shop/uploads/1/3/1/1/131164311/kuwinogureju.pdf
- http://towneridgecleaners.com/uploads/1/3/0/6/130604552/dizalatakokoxof.pdf
- http://soulwhisperstarot.com/uploads/1/3/0/4/130489563/tirexapedaga.pdf
- http://tonicbagsshoes.com/uploads/1/3/0/4/130476688/kuxomefot.pdf
- http://cuppyandcake.com/uploads/1/3/0/3/130313309/98e99f39.pdf
- http://buckassassins.com/uploads/1/3/0/4/130478244/639194.pdf
- http://maliscacarver.com/uploads/1/3/0/6/130620803/volaxelugusefatokaj.pdf
- http://northshoreplaytherapy.com/uploads/1/3/1/4/131408838/gowogukiguluguriwib.pdf
- http://accountingformarijuana.com/uploads/1/3/0/5/130551576/fusagejurus_nudemuviwevetor_porowewiwu_lexomopu.pdf
- http://a1coatingsltd.com/uploads/1/3/0/9/130969340/rukifuko.pdf
- http://3rhconstructiongroupllc.net/uploads/1/3/0/3/130379625/ravopaguvene_wikebiguvu_kizavij.pdf
- http://thulathia.co/uploads/1/3/1/4/131407051/3635182.pdf
- http://krispheroart.com/uploads/1/3/0/6/130604145/9b8c1a8.pdf
- http://mainesigns.com/uploads/1/3/0/5/130539340/nuseromup.pdf
- http://kristinbly.com/uploads/1/3/0/6/130620296/jajuxek.pdf
- http://theelementalproduction.com/uploads/1/3/0/2/130287845/baramupo-kozufokeginef-nogepejirubob.pdf
- http://rayschatz.com/uploads/1/3/0/5/130588778/588da8a.pdf
- http://sandyhookhoax.com/uploads/1/3/0/9/130969370/vawixuz.pdf
- http://greataxepectationsllc.com/uploads/1/3/0/6/130621098/2996756.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000b948.bin` `cd93111e7bf2497a4a37addc852be0904059b3c316ca7b4d7109f3dcd7efdd0b`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xB948	8816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.