PDF malware analysis — malicious · c165a7e52af93248

MALICIOUS

PDF

40.3 KB Created: 2020-05-14 13:17:36 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 8597a39e052a05fbee157ae9bb595812 SHA-1: d8b0a3d903d2cd3ff0111d9c78064499b8681b26 SHA-256: c165a7e52af93248a6af632b03fb41490488371c439d2568949a4e3b5972bfd2

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this pattern, suggesting the document's primary purpose is to direct users to these external resources. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://marmarworld.com/uploads/1/3/0/2/130273790/130273790.html#web+archive+er+key
- http://schneider-math.com/uploads/1/3/0/4/130483981/depatelu.pdf
- http://deebeonit.com/uploads/1/3/0/7/130739343/varowijize.pdf
- http://dscreet.com/uploads/1/3/0/4/130483558/xawozipanuz.pdf
- http://sunsetplaza.org/uploads/1/3/0/6/130620782/abfcae17b11865.pdf
- http://victoriawhaley.com/uploads/1/3/0/5/130550772/461670.pdf
- http://leadershipbreakthroughcoaching.com/uploads/1/3/0/3/130324340/98861d0ca2c.pdf
- http://cocktailsexpress.com/uploads/1/3/1/1/131164352/743566.pdf
- http://thelookingglass1996.net/uploads/1/3/0/9/130969497/c15b4f3.pdf
- http://duncannonag.com/uploads/1/3/0/7/130739892/dexewek_nakupi_lerugodop.pdf
- http://sconniehealthandsurvival.com/uploads/1/3/0/4/130476684/9202996.pdf
- http://anushkaescort.com/uploads/1/3/0/2/130270872/da0fc99e88.pdf
- http://shiburiinc.com/uploads/1/3/0/5/130539340/zulox_fizipasawim.pdf
- http://tanyapinto.org/uploads/1/3/0/5/130588145/5004620.pdf
- http://rooflocators.com/uploads/1/3/0/2/130270798/9024646.pdf
- http://unionofbliss.com/uploads/1/3/0/8/130814011/3655082.pdf
- http://newflavorhouseinc.com/uploads/1/3/1/3/131379530/mabef.pdf
- http://anewayteachingconsultant.com/uploads/1/3/0/8/130874416/rufuker.pdf
- http://kristenyee.com/uploads/1/3/0/9/130969644/3816127.pdf
- http://myplanetearthgallery.com/uploads/1/3/0/7/130776167/lerunolupojem.pdf
- http://mkecabinets.com/uploads/1/3/1/4/131406270/8782328.pdf
- http://angiessoulspace.com/uploads/1/3/0/6/130603802/9781281.pdf
- http://speakingofspartans.com/uploads/1/3/0/7/130775118/0c55e14de.pdf
- http://ketone.com/uploads/1/3/0/6/130620673/pimijofisatuza.pdf
- http://nobleworkshumorcards.net/uploads/1/3/1/4/131437566/kekejaretoroxep_nuvupupowo_duwatav.pdf
- http://vnandusimmigration.com/uploads/1/3/0/6/130603904/4895616.pdf
- http://myplanetearthgaller
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000070c6.bin` `aa1abe58f0ba2161c485702c03dca453b39e2565a512c3e1e1a246b2e146c6c7`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x70C6	10548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.