PDF malware analysis — malicious · c66a94abb5c77718

MALICIOUS

PDF

44.3 KB Created: 2020-03-30 02:10:01 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 67165044cbeaff24fbbd0a275d307d22 SHA-1: f8ca4d89b47e2d4bd17700f884a6b2d153d67244 SHA-256: c66a94abb5c7771829d8a58002d80b6338d08177d459f43dd95dbeff6458de6c

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic. These links point to various domains, many of which appear to be hosting PDF files with numeric or slug-based filenames. The primary purpose seems to be directing users to these external resources, potentially for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted, limiting the analysis of direct payload execution.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://74-123-73-159.mgwnet.com/uploads/1/3/0/4/130493476/130493476.html#the+twilight+zone+midnight+sun+cast
- http://triparoundmyworld.com/uploads/1/3/0/4/130476572/sokosij-junijakukowura.pdf
- http://joe-otoole-photography.com/uploads/1/3/0/6/130604639/5904095.pdf
- http://maiershoch.com/uploads/1/3/0/3/130323381/wekekegalotusot.pdf
- http://morganhomesliving.com/uploads/1/3/1/3/131381374/33e4744ef757dd.pdf
- http://amazingamericanstv.com/uploads/1/3/0/4/130479082/vukunuronaguvup.pdf
- http://anaysabel.com/uploads/1/3/0/7/130776724/zetifudifo.pdf
- http://hollyshoppers.com/uploads/1/3/0/5/130547112/vebuxosesabo.pdf
- http://extendedroadsdelivery.com/uploads/1/3/0/5/130589331/8489318.pdf
- http://sognidolcigluten-freeproducts.com/uploads/1/3/0/8/130813413/2e5ffb99e8.pdf
- http://mangalica.fr/uploads/1/3/1/3/131379608/8264894.pdf
- http://topiarycatalog.com/uploads/1/3/1/0/131070491/e81f1dfce1db3c.pdf
- http://amfashion.org/uploads/1/3/0/2/130289063/papobabeveveje.pdf
- http://advicebysteph.com/uploads/1/3/0/6/130620796/mujosix.pdf
- http://hotmessmomoirs.com/uploads/1/3/1/0/131071035/rewixivuvuxu.pdf
- http://anthonyramosblog.com/uploads/1/3/0/5/130542948/vavujixefosugiwen.pdf
- http://jeffrobinsonlcsw.com/uploads/1/3/0/4/130436197/mowuduvepesij.pdf
- http://melissapadalecki.com/uploads/1/3/0/2/130272071/577a188.pdf
- http://mnalifestyleconnections.com/uploads/1/3/0/8/130814157/99f4375d.pdf
- http://easytobuyahouse.com/uploads/1/3/0/6/130604983/rijunoweko-nazumiji.pdf
- http://candisc.net/uploads/1/3/0/5/130590164/katekedidoxolidire.pdf
- http://opensolpro.com/uploads/1/3/0/7/130775679/genimexevigus-rutusunad-xabodenojegefa-gezajujis.pdf
- http://dazzlingweddingsandevents.com/uploads/1/3/0/2/130288909/9960598.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007c31.bin` `b2e1bae7451933246f9d7f7ecb0bdd9e1bb882387b07cf02df2f64ef6385c009`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7C31	7844 bytes
`font_01_sfnt_off00009acb.bin` `7863b829de04ea8b7f5be4d5dae43fa62182e7611f0c3a300d10b316d27db496`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9ACB	2732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.