MALICIOUS
62
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1204.002 Malicious Link
The PDF file contains a large number of external links to various domains, indicating a link farm or SEO poisoning attempt. The document body, though partially corrupted, contains references to 'abaqus cae documentation 6.13' and 'wkhtmltopdf', suggesting a lure for technical documentation. The primary attack pattern involves directing users to a multitude of PDF files hosted across different subdomains, likely to distribute malware or engage in phishing.
Heuristics 3
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
External URI info PDF_URIPDF contains an external URL action
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL http://kids.ladse.org/uploads/1/3/0/4/130483275/130483275.html#abaqus+cae+documentation+6.13
- http://quillicus.com/uploads/1/3/0/6/130620887/c2b30bbb7.pdf
- http://jmbproducts.com/uploads/1/3/0/5/130542991/mapuxozo.pdf
- http://teaching-philosophy-be-amazing.com/uploads/1/3/0/6/130604699/a75dcbb4da47ef8.pdf
- http://muziksingapore.com/uploads/1/3/0/7/130776673/nuwelulowu.pdf
- http://okpins.net/uploads/1/3/0/2/130288431/5949659.pdf
- http://doicontrol.com/uploads/1/3/0/6/130620767/gazugeviza-jajulibigege-fuzuvuja-lokobezekutimu.pdf
- http://babylon5cards.com/uploads/1/3/0/5/130551708/batajulotobo.pdf
- http://mail.erppartner.ch/uploads/1/3/0/2/130289774/bugekugoxexe.pdf
- http://allaboutgreenvillesc.com/uploads/1/3/0/2/130291658/diwavamijulipo.pdf
- http://weenies.online/uploads/1/3/0/2/130288962/6597958.pdf
- http://xxx666xxx.site/uploads/1/3/0/4/130436089/gegesiloveze-latanoj-pubuzowiguwe-nebaf.pdf
- http://xodessertsandbakery.com/uploads/1/3/0/8/130873856/kepabugalegi-sukutulexerot-tujidabovevexud.pdf
- http://www.sophia-quest.com/uploads/1/3/0/8/130814643/4529c.pdf
- http://norcal-cre.com/uploads/1/3/0/7/130740590/7118089.pdf
- http://manjindersinghmanesh.org/uploads/1/3/0/5/130542692/94b7ebfb9396c0.pdf
- http://jackiefrankeditor.com/uploads/1/3/0/5/130589014/wofizitisiji.pdf
- http://hostmaster.unesco-mab.org.uk/uploads/1/3/0/6/130639573/kijilomafalisunik.pdf
- http://newyorklifeinsuranceattorney.com/uploads/1/3/0/5/130589433/0ce8967a0d60.pdf
- http://rosemarysaromatiking.com/uploads/1/3/0/5/130590672/jefivoseba.pdf
- http://cascading-quilts.com/uploads/1/3/0/3/130324278/7e82be8d178f2.pdf
- http://millionairsgaming.com/uploads/1/3/0/2/130272551/2b6df39074.pdf
- http://elodiepaints.com/uploads/1/3/0/2/130273626/bizozipukufumipexef.pdf
- http://gravanza.com/uploads/1/3/0/2/130287299/rikikiwirupa.pdf
- http://wearelegionofficial.com/uploads/1/3/0/6/130603913/c04b10.pdf
- http://wearelegiono
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off00006e9e.bina0a7ea2117266d58772dd7b2d14fd75182bf89d6ed0f0acbecbff85b62254a60 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x6E9E | 8508 bytes |
font_01_sfnt_off00008e1c.binafd8868629b61d85ec32a8a0de1ca84da82d48156cdd7447d7c4f51403cf5149 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x8E1C | 5244 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.