PDF malware analysis — malicious · be4e229f4e5c5891

MALICIOUS

PDF

43.0 KB Created: 2020-03-25 02:19:17 +02:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 7046d3e6fddb543161e8288c2a24f753 SHA-1: 2ba2197c0e52f33c6b4acba8a195a1a079c88c7a SHA-256: be4e229f4e5c58917acd8aa73140886cc95f57c7f80fbc8619d7901d8c4cf3a1

70 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a lure related to "Masterpiece art auction game instructions" and includes language suggesting urgency, aiming to trick the user into clicking a link. The document is heavily populated with external links, many pointing to PDF files on various domains, suggesting a link farm or redirection mechanism. No scripts were extracted, and the primary malicious activity appears to be the hosting and linking to external malicious content.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://allamericanhandyman.org/uploads/1/3/1/3/131379940/131379940.html#masterpiece+art+auction+game+instructions
- http://veraluceconsulting.com/uploads/1/3/0/7/130776413/julesi.pdf
- http://www.mischawelsh.org/uploads/1/3/0/3/130313729/3585520.pdf
- http://bestbefrank.com/uploads/1/3/0/6/130620163/dazumawu.pdf
- http://beautifulpinkk.com/uploads/1/3/0/3/130323206/1662331.pdf
- http://zyllamusic.com/uploads/1/3/0/8/130873875/duwutavesu_wupadumorupuzit_fugajadevuk_jipere.pdf
- http://sixiememonde.org/uploads/1/3/0/7/130775361/5419886.pdf
- http://www.deerrootsfeeders.com/uploads/1/3/0/2/130288924/boluvipifebawe-xarug-kufofetoxekefow.pdf
- http://missusvicarious.com/uploads/1/3/0/5/130539225/2bc39cd01.pdf
- http://nicholemannion.com/uploads/1/3/0/8/130813427/7406445.pdf
- http://www.go-en.jp/uploads/1/3/0/9/130969327/7ad6638d268ef4.pdf
- http://oilschemicalslubricants.com/uploads/1/3/0/5/130589121/kasipizotebogot.pdf
- http://opps57.com/uploads/1/3/0/6/130620410/kapawuriru-jajunelewog.pdf
- http://meyanahotel.com/uploads/1/3/0/5/130588787/vasobuwo_jisudu_lokozipem_fakuzuzimit.pdf
- http://lifeonthepositive.com/uploads/1/3/0/6/130639672/2352723.pdf
- http://thenewblackcodes.com/uploads/1/3/0/7/130739183/b1f1755de5.pdf
- http://birthintheknow.org/uploads/1/3/0/2/130272940/badajakitizemud_tokegali_furadesi_salatexufexebov.pdf
- http://monsieurpl.com/uploads/1/3/0/6/130639734/b9ad9e5b1.pdf
- http://majorfamilyservices.com/uploads/1/3/0/6/130639801/dirurawa_jenej_gaxotusevo_kiguka.pdf
- http://middleschoolela.com/uploads/1/3/0/4/130489909/xulupetop.pdf
- http://www.premedwizard.com/uploads/1/3/0/3/130313166/mipasuxalogodexu.pdf
- http://dawsonspringsha.com/uploads/1/3/0/6/130620873/jiwusu.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007cf1.bin` `87580f50ab36e6fe209fe80ed3d271d9321f29cb405a74667f9ec4644f261cd3`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7CF1	8956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.