Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e6a4dd5f50e80e0…

MALICIOUS

PDF

23.0 KB Created: 2019-04-30 11:20:25 +01:00 Authoring application: mPDF 5.7
MD5: 88014424258e13a8f5b499b19ea21d19 SHA-1: 8df5199af97e818729c584a2d33ad3041437e9e6 SHA-256: 2e6a4dd5f50e80e096263cd24891569a0fe4779e7e0f74984d852b3a70f5fd4b
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs, many of which are structured as book titles with numeric slugs. This pattern is indicative of a link farm designed to manipulate search engine results or to distribute potentially malicious content. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1735731733732735/Bell-of-the-Desert-The-Life-and-Times-of-Gertrude-Bell-The-Woman-Who-Created-Iraq-by-Alan-Gold.pdf
    • http://cefasfese.4pu.com/1731738739737735730/Gertrude-Bell-The-Arabian-Diaries-1913-1914-by-Gertrude-Bell.pdf
    • http://cefasfese.4pu.com/1735736738737/Bell-Alexander-Graham-Bell-and-the-Conquest-of-Solitude-by-Robert-V-Bruce.pdf
    • http://cefasfese.4pu.com/8732737739731/Ain-t-I-a-Woman-Black-Women-and-Feminism-by-bell-hooks.pdf
    • http://cefasfese.4pu.com/1731736735732732737/H-llenjagd-Ein-Isaac-Bell-Roman-Reihenfolge-der-Isaac-Bell-Abenteuer-1-by-Clive-Cussler.pdf
    • http://cefasfese.4pu.com/8739730735734/Witch-s-Bell-4-Witch-s-Bell-4-by-Odette-C-Bell.pdf
    • http://cefasfese.4pu.com/2734732732734733/Zatch-Bell-Volume-1-Zatch-Bell-1-by-Makoto-Raiku.pdf
    • http://cefasfese.4pu.com/7733739730734/Darius-Bell-and-the-Glitter-Pool-Darius-Bell-1-by-Odo-Hirsch.pdf
    • http://cefasfese.4pu.com/3734739736730735/Wounds-of-Passion-A-Writing-Life-by-bell-hooks.pdf
    • http://cefasfese.4pu.com/3739738736731735/Life-Seemed-Good-But-A-Collection-of-Short-Quirky-Stories-by-Richard-J-Bell.pdf
    • http://cefasfese.4pu.com/1730732736737730/The-Man-Who-Knew-The-Life-and-Times-of-Alan-Greenspan-by-Sebastian-Mallaby.pdf
    • http://cefasfese.4pu.com/2732738732735738/For-Whom-The-Bell-Tolls---The-Snows-Of-Kilimanjaro---Fiesta---The-Short-Happy-Life-Of-Francis-Macomber---Across-The-River-And-Into-The-Trees---The-Old-Man-And-The-Sea-by-Ernest-Hemingway.pdf
    • http://cefasfese.4pu.com/2731737734735737/Light-This-Candle-The-Life-amp-Times-of-Alan-Shepard--America-s-First-Spaceman-by-Neal-Thompson.pdf
    • http://cefasfese.4pu.com/1734733738737731/Churchill-s-Folly-How-Winston-Churchill-Created-Modern-Iraq-by-Christopher-Catherwood.pdf
    • http://cefasfese.4pu.com/2738737738733732/Strong-Survival-The-Life-And-Times-Of-A-Mountain-Woman-by-Cliffie-Strong.pdf
    • http://cefasfese.4pu.com/1734731735732739/Towers-of-Gold-How-One-Jewish-Immigrant-Named-Isaias-Hellman-Created-California-by-Frances-Dinkelspiel.pdf
    • http://cefasfese.4pu.com/7731734739730730/Naomi-Torrente-The-History-of-a-Woman-by-Gertrude-F-De-Vingut.pdf
    • http://cefasfese.4pu.com/4736738734737737/The-Revolution-and-Woman-in-Iraq-by-Saddam-Hussein.pdf
    • http://cefasfese.4pu.com/4733731732732736/Desert-Gold-by-Zane-Grey.pdf
    • http://cefasfese.4pu.com/3732733732732739/Mrs-P-s-Journey-The-Remarkable-Story-of-the-Woman-Who-Created-the-A-Z-Map-by-Sarah-Hartley.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.