PDF malware analysis — malicious · d85597041f47bde8

MALICIOUS

PDF

42.6 KB Created: 2020-03-31 19:31:04 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 88d0c61d6a746eec6897c0b47f147e49 SHA-1: ba7c4c21a2e76ac2633ed0d6c581441df17cd3dc SHA-256: d85597041f47bde8da2f97c1c0eb619b1f8a14d2c1a905ede7f8a3c81a08a78b

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file masquerades as a sewing machine manual but contains a large number of external links, a technique often used for SEO spam or to distribute further malicious content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external links, with 'uncommonjose.com' being a dominant host. While no scripts were extracted, the sheer volume of links suggests a malicious intent to redirect users to potentially harmful sites.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://sheriffproperties.com/uploads/1/3/0/5/130551399/130551399.html#brother+xl+5500+sewing+machine+user+manual
- http://uncommonjose.com/uploads/1/3/0/7/130739493/lixujimovosajasutu.pdf
- http://hostmaster.epc-energiedeskundige.be/uploads/1/3/0/6/130605501/b9a869.pdf
- http://eogandcysyoga.com/uploads/1/3/0/7/130775129/cad4406e5.pdf
- http://vibrapure.com/uploads/1/3/1/0/131071038/7013588.pdf
- http://lowesttruckinsurance.com/uploads/1/3/0/7/130740517/cd9b25d3f0.pdf
- http://seven7fourteenboutique.com/uploads/1/3/0/6/130622103/lukasexafit.pdf
- http://anastasiaosho.com/uploads/1/3/0/5/130550920/vezesula.pdf
- http://casesforandroid.com/uploads/1/3/1/0/131070761/3809936.pdf
- http://gladcpr.com/uploads/1/3/1/3/131381443/294931.pdf
- http://slambry.com/uploads/1/3/0/4/130435509/1229273.pdf
- http://hetrickco.com/uploads/1/3/0/6/130621071/442883.pdf
- http://stnrphoto.com/uploads/1/3/0/6/130620613/9860035.pdf
- http://www.flannelstate.com/uploads/1/3/0/4/130478205/fasanog_pomen.pdf
- http://wtwcustomjewelry.com/uploads/1/3/0/7/130775834/jilibosume.pdf
- http://zenexbcs.com/uploads/1/3/0/8/130814575/f22a3383f38fa.pdf
- http://especialpack.com/uploads/1/3/1/3/131379877/rudufofax.pdf
- http://fiestadelespanol.org/uploads/1/3/0/7/130775685/baporuz_xosiwuzi_busenanugin.pdf
- http://weeblystatic.com/uploads/1/3/0/6/130603942/sabaxipitina_nuzixedo.pdf
- http://bhpcd.org/uploads/1/3/0/8/130874007/xepebaniron-fenirox-totoxelozemopu-jofezara.pdf
- http://ironanvil.org/uploads/1/3/0/6/130639172/menagijuxezi_xikojudavotux_dilatis.pdf
- http://tnems.net/uploads/1/3/0/7/130738550/jezotumus-pulupi-waragomipaxola-jikabu.pdf
- http://theschoolofdivination.com/uploads/1/3/0/2/130289561/9064b68c682860e.pdf
- http://garchouestore.shop/uploads/1/3/0/6/130621785/56ab2ee58.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000758f.bin` `bbe2a292b2f6236692ad81ae62a97e8b43ce877bce6748c2cf4980f1c1422de4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x758F	7388 bytes
`font_01_sfnt_off00009286.bin` `e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x9286	2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.