Malicious PDF — malware analysis report

Static analysis result for SHA-256 30ef2982c9aa0bd3…

MALICIOUS

PDF

18.4 KB Created: 2019-11-09 23:30:16 +00:00 Authoring application: mPDF 5.7
MD5: 5efb2e13868a0599619c9bddb3d27999 SHA-1: cf65e746aa89d9ec1a1470f1bd1cba4de53d09e6 SHA-256: 30ef2982c9aa0bd3e8660b78753ecc54d0ecae5a3987546adaf05a6163a547c9
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, forming a link farm pointing to external PDF files. The heuristic PDF_SEO_LINK_FARM indicates this is a technique to artificially inflate search engine rankings or distribute content. While the URLs themselves are marked as benign, the sheer volume and the suspicious domain suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4732735736734735/Ghost-Hunt-Vol-2-Ghost-Hunt-2-by-Shiho-Inada.pdf
    • http://cefasfese.4pu.com/3739735733733732/Ghost-Hunt-Vol-9-Ghost-Hunt-9-by-Shiho-Inada.pdf
    • http://cefasfese.4pu.com/3738731739733735/We-re-Going-on-a-Ghost-Hunt-by-Marcia-K-Vaughan.pdf
    • http://cefasfese.4pu.com/1737730732730734/Roulette-Love-Is-A-Losing-Game-The-Thomas-Hunt-Series-1-by-Sam-J-D-Hunt.pdf
    • http://cefasfese.4pu.com/8730739735733737/Manga-Publicado-En-Nakayoshi-Sailor-Moon-Cardcaptor-Sakura-Tokyo-Mew-Mew-Candy-Candy-Shugo-Chara-Jigoku-Sh-Jo-Ashita-No-Nadja-Ghost-Hunt-Magic-Knight-Rayearth-Mermaid-Melody-Pichi-Pichi-Pitch-DOS-Fuera-de-Serie-by-Source-Wikipedia.pdf
    • http://cefasfese.4pu.com/4732739730737733/Hunt-Through-the-Cradle-of-Fear-Gabriel-Hunt-2-by-Gabriel-Hunt.pdf
    • http://cefasfese.4pu.com/1731738732730732735/Izzy-Spector---Ghost-Detector-The-Ghost-Dog-of-Hill-Road-by-Robert-Spielman.pdf
    • http://cefasfese.4pu.com/2731732730730730/Man-Hunt-Man-Hunt-1-by-K-Edwin-Fritz.pdf
    • http://cefasfese.4pu.com/3737735730737732/Ghost-a-la-Mode-A-Ghost-of-Granny-Apples-Mystery-1-by-Sue-Ann-Jaffarian.pdf
    • http://cefasfese.4pu.com/3736730737737738/Ghost-of-a-Threat-Betty-Boo-Ghost-Hunter-1-by-Beth-Dolgner.pdf
    • http://cefasfese.4pu.com/2735735730734736/All-for-the-Union-The-Civil-War-Diary-amp-Letters-of-Elisha-Hunt-Rhodes-by-Robert-Hunt-Rhodes.pdf
    • http://cefasfese.4pu.com/3735733737736737/Giving-Up-the-Ghost-Laying-a-Ghost-2-by-Jane-Davitt.pdf
    • http://cefasfese.4pu.com/7735731733735/Ghost-Layer-Ghost-Seer-2-by-Robin-D-Owens.pdf
    • http://cefasfese.4pu.com/2734730730737736/Ghost-in-the-Cowl-Ghost-Exile-1-by-Jonathan-Moeller.pdf
    • http://cefasfese.4pu.com/3731736739732/The-Ghost-Drum-Ghost-World-1-by-Susan-Price.pdf
    • http://cefasfese.4pu.com/9734738736732738/Ghost-Coast-Ghost-in-the-Shell-11-by-Masamune-Shirow.pdf
    • http://cefasfese.4pu.com/2734730730736739/Ghost-in-the-Flames-Ghost-2-by-Jonathan-Moeller.pdf
    • http://cefasfese.4pu.com/2736736739730730/I-Hunt-Killers-I-Hunt-Killers-1-by-Barry-Lyga.pdf
    • http://cefasfese.4pu.com/4739739733738734/Witch-Hunt-Witch-Hunt-1-by-Nick-Chivers.pdf
    • http://cefasfese.4pu.com/4737737731732730/Monster-Hunt-NYC-Monster-Hunt-NYC-1-by-Harmon-Cooper.pdf
    • http://cefasfese.4pu.com/3737735730737732/Ghost-a-la-Mode-A-Ghost-of-Granny-A

Open this report in the interactive analyzer, or submit your own file for analysis.