Malicious PDF — malware analysis report

Static analysis result for SHA-256 37f5978270295a4f…

MALICIOUS

PDF

16.3 KB Created: 2019-05-01 18:05:06 +01:00 Authoring application: mPDF 5.7
MD5: 6a9d60fbda587f259e5d028d15a784e2 SHA-1: e771b0a2b64cb0569889af07cda8a74c3a1d2157 SHA-256: 37f5978270295a4fa39f3f39c50a59e8e3805cb644a0f90a60969693c96b78cd
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, many of which are hosted on the dynamic DNS domain xiixmcuin.linkpc.net. This pattern is indicative of SEO spam or a link farm designed to distribute content or potentially lead users to malicious sites. The heuristic 'PDF_SEO_LINK_FARM' strongly supports this assessment. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the immediate payload.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/9202201209203203/20-000-Leagues-Under-the-Sea-1000-Copy-Limited-Edition-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/9202201209209207/Journey-to-the-Center-of-the-Earth-1000-Copy-Limited-Illustrated-Edition-SF-Classic-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/9202201209202208/The-War-of-the-Worlds-1000-Copy-Limited-Edition-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/9202201209203207/The-Age-of-Innocence-1000-Copy-Limited-Edition-by-Edith-Wharton.pdf
    • http://xiixmcuin.linkpc.net/9202201208203206/The-Metamorphosis-1000-Copy-Limited-Edition-by-Franz-Kafka.pdf
    • http://xiixmcuin.linkpc.net/9202202200200208/The-Jungle-Book-1000-Copy-Limited-Edition-by-Rudyard-Kipling.pdf
    • http://xiixmcuin.linkpc.net/9202202200205204/A-Princess-of-Mars-1000-Copy-Limited-Edition-by-Edgar-Rice-Burroughs.pdf
    • http://xiixmcuin.linkpc.net/9202202200201201/Swann-s-Way-In-Search-of-Lost-Time-1000-Copy-Limited-Edition-by-Marcel-Proust.pdf
    • http://xiixmcuin.linkpc.net/9202202200205208/The-Legend-of-Sleepy-Hollow-and-Other-Stories-1000-Copy-Limited-Edition-Or-the-Sketch-Book-of-Geoffrey-Crayon-Gent-by-Washington-Irving.pdf
    • http://xiixmcuin.linkpc.net/5205201201201209/Twenty-Thousand-Leagues-Under-The-Sea-By-Jules-Verne-Illustrated-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/8206206201204207/20-000-Leagues-Under-The-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/5203201203201203/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/1200201208202204206/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/6209209202201205/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/9206202201204207/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/3202200200201205/20000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/7200207206202/Twenty-Thousand-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/4208201202204209/Twenty-Thousand-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/1200203206202201200/Twenty-Thousand-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/1200204201208209208/20-000-Leagues-Under-the-Sea-Includes-eBook-by-Jules-Verne.pdf
    • http://xiixmcuin.linkpc.net/9202202200205208/The-Legend-of-Sleepy-Hollow-and-Other-Stories-1000-Copy-Limited-Edition-Or-the-Sketch-Book-of-Geoffrey-Crayon-Gent-by-W

Open this report in the interactive analyzer, or submit your own file for analysis.