PDF malware analysis — suspicious · ea926e52a1517bd6

SUSPICIOUS

PDF

88.9 KB Created: 2016-12-26 20:24:01 +08:00 First seen: 2018-10-07

MD5: 766af58a58e269b1988c582b4710be1c SHA-1: e8661ebd353e788f796e6cb19b02236badc351da SHA-256: ea926e52a1517bd65623b76cce462b85f1a76619f80f874a50f05e35d9cc102f

42 Risk Score

Machine Learning

Nyx PDF Classifier clean score 0.0313

Heuristics 4

PDF carries a PHP-gateway SEO-spam PDF link farm medium PDF_SEO_PHP_GATEWAY_LINK_FARM

PDF contains four or more clickable links whose target is a `.php` gateway with a multi-word search-PHRASE document slug embedded after it (e.g. 'index.php?.../binary+options+trading+nz.pdf' or 'pdf.php/cialis-dosage-side-effects.pdf'). Legitimate PHP-served documents use a filename or numeric id, not a search-query phrase, so this is the generated SEO link-farm shape — pharma / binary-options / 'free download' spam that ranks for queries and routes users into payload/redirect chains. The PDF itself carries no exploit — the risk is the linked destinations.
Embedded JS stream low PDF_JS

PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://dubaipropertyrentals.net/organizefree/carrydetermine.php/lYGbfihazzvkwbtlPekPlkkrroPe16217738sv.pdf PDF link annotation
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/inetwdodcnafeucxzkYbwnuJxQer16217312rs.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/rzbkvs_16217973tQb.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/kdYhJmhi_wudPbPxaQeQanz16217532_Puf.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/aiin16218008Yto.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/mbwrlanoYaPuYzschur16217193af.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/iemYmuxevvwku16217841kza.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/QbvnfGn_Quw16217511_Jxx.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/hzitwmrP_J_Ynudx_ir16217890ufrG.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/fGtaxmxtooYxddlibz16218089Q.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/Gaf_P16217315v.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/hckvYnYuYYPedYJP16217644Phw.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vmfdGoaoaG16217676d_.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/Gbo16217764a.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/kvsxtJY16217423t.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/cfvblsinnJQat_xJe16217595duQ.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/nGiwxJfsmmoi16217636x.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/ielx16218179vbw.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/GGJQwrJlknwhPoim16217484P_Y.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/ke_ffchvkcP16217731ds.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/fek16217661_wa.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/clrYnmrvxddfJrPkwQwnvbk_n16217237hYn.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xbxtnmxi16218015z.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/GzmvfuQftr16217621o.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/rtGalczv_QJwddQciP16217241Jn.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/iisdrGmkYkaicewcJilP_Gh16217526lP.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/umvovbzQknk_wiaxiQmoYefifn16217675d.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_GsrohPbraivozdkcmevYmJvxrQio16217966rQ.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/d_etxhmiiJ_xwh_lusetxzsmckf16218160b_.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/uhGlch16217915ku.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wzuPcYuiQlxmfzmrGQfverwicxo16218111w.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/lPbdertJoo__tcmQetw_tztz16217290fYik.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vll16217758n_.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/oezc16217625sddx.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_ltnQunQYuJfxk_zubfrscPPYxwizr16217522bu.pdfIn PDF document text
- http://cardoor.es/talkremain/cxJmoQQJ_15700189l.pdfIn PDF document text
- http://thegoprofamily.com/specialarm/adfe15903841bxva.pdfIn PDF document text
- http://goldae.ch/css/ewn15682991Yd.pdfIn PDF document text
- http://goldae.ch/js/JucJlr15892277ht.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/wlvd_xskmJrlez_x16217534YPkm.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/_monrddratuledvlJmndrYbGxofGhk16218043w.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/Gc_euzk16217907oxwn.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/YotehnvvlwfkvskJGJhii_GeQsJ16217822omeG.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/QohzcbzYknvP_GeJGm16217868QhzJ.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xf_owlcknfJukPvccYmlw_ncono16217794ai.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/unoludedPkdJlvkzvhv__G16217945Qhm.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/marbGkYaaQmGwcubcxnsl_G16217320koac.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/xuhhrsGwhn16217782m.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/vGb_xxvJeYzhwQulJiziwzw16217990Q.pdfIn PDF document text
- http://dubaipropertyrentals.net/organizefree/carrydetermine.php/owumatQxaJckQltlrYzirl16217646_zhe.pdfIn PDF document text
+28 more URL(s)

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`stream_005_off0000bc8a.bin`	decompressed-pdf-stream	PDF FlateDecoded stream at offset 0xBC8A	19856 bytes
SHA-256: `a930245e90be17a336a7679d31e9d416ddec66c65020bec75b59b2e2bfc19120`
`font_01_sfnt_off0000f220.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xF220	19964 bytes
SHA-256: `5154a7c8cf7a9b55c2f939ad6a4a8f8327cd6552b9f68a87c49d10dfc747eaa8`
`font_02_sfnt_off000127e6.bin`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x127E6	20828 bytes
SHA-256: `66ee5a421be874c2bf64758e212dcdc74f7e5fbd5b562db26553446e87a084f1`

Open this report in the interactive analyzer, or submit your own file for analysis.

PDF

Machine Learning

Heuristics 4

Related samples 8

Extracted artifacts 3