Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d0fb73d5ccffff3…

MALICIOUS

PDF

16.5 KB Created: 2020-03-12 01:40:45 +00:00 Authoring application: mPDF 5.7
MD5: 50484e22a2b0a1f81deeb8dd2c54f15d SHA-1: bef625c575a2c511bf5851a9e71c5699bee53a4a SHA-256: 1d0fb73d5ccffff30774d16befad1c4d5102bc2c729e14ee45546d10dd6c2108
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates this is a critical finding, suggesting the document's purpose is to distribute external links. The extracted URLs are all hosted on the same domain, 'ieuicufioao.myhome.cx', and appear to be book-related, likely a lure to disguise malicious intent. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/1550551557556/Gabriel-s-Redemption-Gabriel-s-Inferno-3-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/3552559558553/Gabriel-s-Rapture-Gabriel-s-Inferno-2-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/3553554550553559/Gabriel-s-Inferno-Gabriel-s-Inferno-1-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/3550553551555/Gabriel-39-s-Rapture-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/1557559556557559/Gabriel-s-Revenge-The-Adventures-of-Gabriel-Celtic-2-by-J-T-Lewis.pdf
    • http://ieuicufioao.myhome.cx/6553550557557552/Redemption-The-Life-of-St-Mary-Euphrasia-PELLETIER-by-gabriel-francis-powers.pdf
    • http://ieuicufioao.myhome.cx/7550552556/The-Man-in-the-Black-Suit-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/1558558552552557/The-Raven-The-Florentine-1-by-Sylvain-Reynard.pdf
    • http://ieuicufioao.myhome.cx/2559552556558558/Gabriel-Garcia-Marquez-3-volume-set-Strange-Pilgrims-Love-in-the-Time-of-Cholera-One-Hundred-Years-of-Solitude-by-Gabriel-Garc-a-M-rquez.pdf
    • http://ieuicufioao.myhome.cx/4552559550557553/Hunt-Through-the-Cradle-of-Fear-Gabriel-Hunt-2-by-Gabriel-Hunt.pdf
    • http://ieuicufioao.myhome.cx/1551551557555552553/Gabriel-Garc-a-M-rquez-The-Last-Interview-and-Other-Conversations-The-Last-Interview-Series-by-Gabriel-Garc-a-M-rquez.pdf
    • http://ieuicufioao.myhome.cx/4552558559557558/Hunt-at-World-s-End-Gabriel-Hunt-3-by-Gabriel-Hunt.pdf
    • http://ieuicufioao.myhome.cx/4553551553552555/Hunt-at-the-Well-of-Eternity-Gabriel-Hunt-1-by-Gabriel-Hunt.pdf
    • http://ieuicufioao.myhome.cx/5557551555556557/Sirius-by-Gabriel-J-M-.pdf
    • http://ieuicufioao.myhome.cx/3552554550557550/The-Liberation-of-Gabriel-King-by-K-L-Going.pdf
    • http://ieuicufioao.myhome.cx/2557556554559551/Dayling-by-Gabriel-Madison.pdf
    • http://ieuicufioao.myhome.cx/3555551558556553/Gabriel-by-Chris-Lange.pdf
    • http://ieuicufioao.myhome.cx/4558551554555555/Gingerbread-by-Gabriel-Daemon.pdf
    • http://ieuicufioao.myhome.cx/4555559559555559/Still-Waters-by-Alex-Gabriel.pdf
    • http://ieuicufioao.myhome.cx/3552559552556557/The-Martian-War-by-Gabriel-Mesta.pdf
    • http://ieuicufioao.myhome.cx/4552559550557553/Hunt-Through-the-Cradle-of-Fea

Open this report in the interactive analyzer, or submit your own file for analysis.