General
-
Target
FVA1207-00000528.pdf
-
Size
1.8MB
-
MD5
63d7f1bf72cf53df7fb617d70e29ef0f
-
SHA1
a8d37bbdd46528068e44e7a1cd2cf68922eecdee
-
SHA256
90f9cf8c6c4e35c665cb8455649295d5c14a280c47f6180cedfb734d754e8da1
-
SHA512
74262dd6198546e73dec8e28c886eb102e6b581107df5eb7e20a8374ff35fa5d7cc3e5d655ae36e96b636965e81a4d823e8f4b28e81467796a34ebe67e0bbc50
-
SSDEEP
24576:5XyeazbwKKKKKKB/QSDWOuNAof8CAQ43XxTih4jzYkTecjH9A4QjNSiM6fgJ:WzwQiWVAo0cJh4jzjC5jwvwE
Malware Config
Signatures
-
PDF has QR code that contains a HTTP URL
PDFs with URL QR codes are often used for phishing
-
One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
Files
-
FVA1207-00000528.pdf
-
https://www.afip.gob.ar/fe/qr/?p=eyJ2ZXIiOjEsImZlY2hhIjoiMjAyNC0wOC0wNiIsImN1aXQiOjMwNzA4OTkyMzAxLCJwdG9WdGEiOjEyMDcsInRpcG9DbXAiOjEsIm5yb0NtcCI6NTI4LCJpbXBvcnRlIjo3MjMxMDkuODIsIm1vbmVkYSI6IlBFUyIsImN0eiI6MS4wLCJ0aXBvRG9jUmVjIjo4MCwibnJvRG9jUmVjIjozMzcxNzQxMTgwOSwidGlwb0NvZEF1dCI6IkUiLCJjb2RBdXQiOjc0MzIxNTA2NzE0ODg2fQ==
-