General
-
Target
564b60f9773a078550c4da0ab1dc3e3b14a74b2b68f5d6a7fea1e854cf87d02dN
-
Size
246KB
-
MD5
c6d6833f9b6c4eb3ecbd046886025850
-
SHA1
1313987c6e33847ad06c6178486fa13e94f24ccb
-
SHA256
564b60f9773a078550c4da0ab1dc3e3b14a74b2b68f5d6a7fea1e854cf87d02d
-
SHA512
01ba4ffb0305c6dff2fe8227bde504869ce40114dd0a19b4a9e853dbd9ac86480334a88f0f4ad1caf1a1b65f2d5f926d5162c8718a4a67084d624f0e68fb3452
-
SSDEEP
6144:/YBBxcq9XkydleAzyqGe5fUhD319mAbFblyDMJuZBsn/mb/:Vq/7Htst1UYFblyoJubsn/mb/
Malware Config
Signatures
-
PDF has QR code that contains a HTTP URL
PDFs with URL QR codes are often used for phishing
-
One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
Files
-
564b60f9773a078550c4da0ab1dc3e3b14a74b2b68f5d6a7fea1e854cf87d02dN
-
https://kenanabutenepe.joopsoa.com/97841327793651263909733957?kumiwuxolojekedojukubar=xavomifulozotuxejugobevawagotokimogakubonazisevedaparutakavadujejepagobupunimatedusilemajilixonitokamubugekeruxolujutigepoxisegubawugunupinugozulexafaxatutuwusajoluluvedovimojiliwesimivozolijizikebufifarok&utm_term=best+times+to+book+flights+to+china&xamexesijojanazajezewodutixatozizusipulinutopeminobulemivulubapeketukavi=wexanizibuwukipedulimabaradiborenisugexevamaxumovafumosubutodetijafaxolegemejimuremuxelukozidubepomemapozopemewuvasudikivuvamuronobapipurelef
-
https://u.wechat.com/EAHBYqxUNbJo7KLAKCIx53A
-