Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ee644365ddc4abb…

MALICIOUS

PDF

18.9 KB Created: 2019-04-30 20:51:18 +01:00 Authoring application: mPDF 5.7
MD5: 40fca47ede79fa5bce98f083a7f85a39 SHA-1: 92a70d6efa2fa1d6a205dcf7565d460d01e1ee59 SHA-256: 1ee644365ddc4abb7021ca73a5ae1d3f0fcbe5f857079900e59a5d586a065b3a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded links pointing to external PDF files hosted on the dynamic DNS domain 'xiixmcuin.linkpc.net'. This behavior is indicative of a link farm or a content distribution network designed to obscure the ultimate destination or to host a large volume of potentially malicious content. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/4205201207206204/Hana-Kimi-For-You-in-Full-Blossom-Vol-3-Hana-Kimi-For-You-in-Full-Blossom-3-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/4206205206204200/Hana-Kimi-For-You-in-Full-Blossom-Vol-9-Hana-Kimi-For-You-in-Full-Blossom-9-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/5200205204204200/Hana-Kimi-For-You-in-Full-Blossom-Vol-11-Hana-Kimi-For-You-in-Full-Blossom-11-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/5200205204205205/Hana-Kimi-For-You-in-Full-Blossom-Vol-12-Hana-Kimi-For-You-in-Full-Blossom-12-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/4204202203205/Hana-Kimi-For-You-in-Full-Blossom-Vol-1-Hana-Kimi-For-You-in-Full-Blossom-1-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/4206205204209204/Hana-Kimi-For-You-in-Full-Blossom-Vol-7-Hana-Kimi-For-You-in-Full-Blossom-7-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/4205203206206200/Hana-Kimi-3-in-1-Edition-Vol-7-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/4204202200205203/Hana-Kimi-3-in-1-Edition-Vol-2-by-Hisaya-Nakajo.pdf
    • http://xiixmcuin.linkpc.net/8205208206200203/Blossom-Blossom-Trilogy-1-by-Christopher-Lentz.pdf
    • http://xiixmcuin.linkpc.net/8201205209209/Summer-on-Blossom-Street-Blossom-Street-6-by-Debbie-Macomber.pdf
    • http://xiixmcuin.linkpc.net/1206209202203209/Blossom-Street-Brides-Blossom-Street-10-by-Debbie-Macomber.pdf
    • http://xiixmcuin.linkpc.net/3205201201206203/-16-Kimi-ni-Todoke-16-Kimi-ni-Todoke-From-Me-to-You-16-by-Karuho-Shiina.pdf
    • http://xiixmcuin.linkpc.net/3205202204206203/Hana-Du-Rose-The-Hana-Du-Rose-Mysteries-2-by-K-T-Bowes.pdf
    • http://xiixmcuin.linkpc.net/4202200207209/Pick-Up-Game-A-Full-Day-of-Full-Court-by-Marc-Aronson.pdf
    • http://xiixmcuin.linkpc.net/4208203209208206/Full-Blast-Full-Series-4-by-Janet-Evanovich.pdf
    • http://xiixmcuin.linkpc.net/8201206200203/Full-House-Full-1-by-Janet-Evanovich.pdf
    • http://xiixmcuin.linkpc.net/2208202201201208/Full-Bloom-Full-5-by-Janet-Evanovich.pdf
    • http://xiixmcuin.linkpc.net/1202209208209/Blossom-by-Constance-Bennett.pdf
    • http://xiixmcuin.linkpc.net/8203206206203208/Blossom-by-Dale-Butler.pdf
    • http://xiixmcuin.linkpc.net/1205200206202205/The-Blossom-Festival-A-Novel-by-Lawrence-Coates.pdf
    • http://xiixmcuin.linkpc.net/4204202203205/Hana-Kimi-For-You-in-Full-Blossom-Vol-1-Hana-Kimi-For-You-in-Full-Blossom-1-

Open this report in the interactive analyzer, or submit your own file for analysis.