PDF malware analysis — malicious · ed2520ff294f0684

MALICIOUS

PDF

55.7 KB Created: 2020-03-29 07:12:42 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)

MD5: 920e06a2a106d7940869e31bf603fb10 SHA-1: c33aa42529ac6e5fcc8eeec87672a76bf6511a84 SHA-256: ed2520ff294f0684b96c1dff209b4aad37c650ecad2035ab28315b15e8d92fb2

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, a technique often used for SEO manipulation or to distribute malicious payloads. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a mass of external PDF links. The embedded document body text, though partially corrupted, includes a URL that points to a potentially malicious HTML file, further supporting the malicious intent. The primary goal appears to be directing users to a network of linked PDF documents hosted across various domains.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://74-123-72-68.mgwnet.com/uploads/1/3/0/2/130289745/130289745.html#que+es+el+software+libre+ejemplos
- http://changemylife.info/uploads/1/3/0/4/130488153/3513448.pdf
- http://xn--kyourbeauty-fbb.com/uploads/1/3/0/6/130621805/suwibomi_zuwemuzebumu.pdf
- http://realty33nj.com/uploads/1/3/0/6/130604667/1cc155b0b96.pdf
- http://cincybuilder.com/uploads/1/3/0/4/130435881/b4a6c8769203.pdf
- http://asperaarchitects.com/uploads/1/3/0/6/130621182/guxuvolaxobor.pdf
- http://www.invisibleiguana.com/uploads/1/3/0/5/130552017/gosonojo.pdf
- http://hillcountrybenefits.com/uploads/1/3/0/5/130551087/sivuruvimope.pdf
- http://consultupstate.com/uploads/1/3/0/5/130551433/b81713cc866f6b.pdf
- http://carolea-prima.eu/uploads/1/3/0/6/130604129/7228100.pdf
- http://emilygruger.com/uploads/1/3/0/6/130604475/c7f0b.pdf
- http://nikolasstrubbe.com/uploads/1/3/0/5/130588740/zumadogipokadu.pdf
- http://entrepreneursschoolhouse.com/uploads/1/3/0/2/130272851/pefez-levidi-zezebejelow-mavidow.pdf
- http://edinapartybus.com/uploads/1/3/0/8/130813409/204966f518b8e93.pdf
- http://server65123.misscarols.com/uploads/1/3/0/5/130590663/3a8f8a3e4.pdf
- http://susenrumposch.com/uploads/1/3/0/7/130740497/tureketosuzupot_zuxemez.pdf
- http://plandesignco.com/uploads/1/3/0/2/130288392/tulegipigosisi-sisida.pdf
- http://michiganfolkschool.org/uploads/1/3/0/8/130814416/goxanud.pdf
- http://cpanel.jenniegumption.com/uploads/1/3/0/9/130969897/60d9f9aee6.pdf
- http://nexusintouch.com/uploads/1/3/0/4/130476563/4686904.pdf
- http://www.rosigreenberg.com/uploads/1/3/0/6/130604375/wodikevenixuba.pdf
- http://moonshiners.net/uploads/1/3/0/6/130605162/zukipil.pdf
- http://mtymielikki.fi/uploads/1/3/0/6/130604574/lepukeka.pdf
- http://r-ain.com/uploads/1/3/0/7/130775033/452061.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000ad26.bin` `11cc2b3738856f0fc159e35e683c15d1790f72ffe98b6b64a022de4615d85cb1`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xAD26	9536 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.