PDF malware analysis — malicious · fba2337f74b4497a

MALICIOUS

PDF

42.8 KB Created: 2020-05-20 13:54:30 +03:00 Authoring application: wkhtmltopdf 0.12.5 (via Qt 4.8.7)

MD5: 56870bba1ce0c75e40d79dfd7f10f861 SHA-1: b35de9dc45893ba70ab45f11a2f56ace4b15e700 SHA-256: fba2337f74b4497ad9f6439dfb0077acefe3494017cad77b686594d24546188e

62 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic. The document body text, though partially corrupted, includes the phrase 'Empaque y embalaje de ropa para exportar' and references 'wkhtmltopdf', suggesting a lure related to export packaging. The primary attack pattern involves directing users to a multitude of external PDF files hosted on various domains, likely to distribute further malicious content or engage in SEO spam.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
External URI info PDF_URI

PDF contains an external URL action
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://seven16litt.com/uploads/1/3/1/3/131380288/131380288.html#empaque+y+embalaje+de+ropa+para+exportar
- http://escolaximnasiaferrolterra.com/uploads/1/3/0/8/130813796/fujunejalawu.pdf
- http://drainagecleaner.com/uploads/1/3/0/4/130483799/5679402.pdf
- http://eastalabamabikeshare.com/uploads/1/3/0/5/130588231/3b541e4b50.pdf
- http://garciacorpas.com/uploads/1/3/1/8/131856225/ed46d.pdf
- http://megandonnelly.ca/uploads/1/3/1/0/131070327/zisivexeziwegij_kasiroguxinowot_debiso.pdf
- http://slccdburnham.com/uploads/1/3/0/8/130873902/a79d2.pdf
- http://traumallamas.com/uploads/1/3/1/1/131164471/24340a074fe4753.pdf
- http://zstartrading.com/uploads/1/3/0/7/130738771/ripas.pdf
- http://theemafoundation.com/uploads/1/3/1/3/131381782/dosaw.pdf
- http://antonioalopez.com/uploads/1/3/0/7/130740443/bifonopit_putadozopo_gukuverowokutuk.pdf
- http://midnightvapehookah.com/uploads/1/3/1/4/131408178/zuweki_sedodesi_jaxafixujo_redadizofagogup.pdf
- http://elliesjewellery.com/uploads/1/3/1/3/131379223/fc1a01eaba.pdf
- http://nailsbymargaret.com/uploads/1/3/0/6/130604804/77736347b745d.pdf
- http://the-lpg.com/uploads/1/3/0/7/130739530/c226e8.pdf
- http://lectricwind.com/uploads/1/3/0/5/130588210/4880930.pdf
- http://artur-toronto.com/uploads/1/3/0/6/130640105/55fb96.pdf
- http://mindsetgangster.com/uploads/1/3/0/3/130313117/moxepozovul-werasejobunoge-jasufaxis-jowokajupubebi.pdf
- http://besoulfood.com/uploads/1/3/0/9/130969046/fe66b4.pdf
- http://browtricksshop.com/uploads/1/3/0/7/130775465/69526.pdf
- http://giltnertraining.com/uploads/1/3/0/6/130639904/kevowemegawe_tafowunon.pdf
- http://jorax-beveiliging.nl/uploads/1/3/0/5/130551661/fb308c30b8.pdf
- http://younionstudio.com/uploads/1/3/0/7/130739945/4325868.pdf
- http://verablendnutrition.com/uploads/1/3/0/6/130604779/puvasoretuw-pejetezadalu-motofixab-zezopifan.pdf
- http://b83apartments.com/uploads/1/3/0/7/130775768/kuvufoli-fomevikodoluj.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00007bc3.bin` `33c6022184b52907cc8af77e87b35a4eee51384f1b342f468c70728c0e778934`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x7BC3	10264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.