Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c13aa76962341cc…

MALICIOUS

PDF

18.0 KB Created: 2019-05-03 06:25:11 +01:00 Authoring application: mPDF 5.7
MD5: 5cfb1cc5db040c8a77e00cf305ae3a40 SHA-1: d208d3dd90108c051115637f052871c4fa2ef431 SHA-256: 3c13aa76962341cc84a65f884a6c241c071002308fc4a7245c72e09583bceb1e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, all pointing to the same domain 'cefasfese.4pu.com'. This domain appears to be hosting a link farm of other PDF documents, likely as a tactic to manipulate search engine results or distribute content. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate user-facing content. The primary attack pattern observed is the creation of a link farm to distribute or obscure other malicious content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2738737736738730/Fuente-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731732734737/Rent-Boy-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731732733737/Lord-of-the-Manor-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731730737739/The-adventures-of-Jason-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731730738738/The-adventures-of-Jonathan-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731730739735/Aemilius-the-Roman-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731731732731/The-taste-of-blood-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731731730732/The-Grindr-Experiment-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731732734734/Departure-Date-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731731733739/The-adventures-of-Peter-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731732732732/Knights-of-the-Crimson-Seal-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/4735737735733739/The-horse-tribe-of-the-Celts-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731730735736/Home-for-the-holidays-The-adventures-of-Aaron-Book-1-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/1736731732735730/The-Grindr-Experiment-Adventures-with-the-App-that-has-changed-the-game-for-gay-men-by-Gareth-Johnson.pdf
    • http://cefasfese.4pu.com/4732733735735739/The-Devil-and-Ms-Johnson-by-Hannah-Murray.pdf
    • http://cefasfese.4pu.com/1731738736737738731/The-Enlightened-Smoker-s-Guide-to-Quitting-Learn-to-Forget-to-Smoke-by-Bear-Jack-Gebhardt.pdf
    • http://cefasfese.4pu.com/1731738736737738732/The-Enlightened-Smoker-s-Guide-to-Quitting-A-Radical-New-Approach-to-Stop-Smoking-by-B-Jack-Gebhardt.pdf
    • http://cefasfese.4pu.com/1730738730738737737/An-Atheist-Epic-Bill-Murray-the-Bible-and-the-Baltimore-Board-of-Education-by-Madalyn-Murray-O-39-Hair.pdf
    • http://cefasfese.4pu.com/3739739738731737/Legends-of-the-Black-Orchid-by-Murray-Ian-Murray.pdf
    • http://cefasfese.4pu.com/4733737732731737/Pauli-Murray-The-Autobiography-of-a-Black-Activist-Feminist-Lawyer-Priest-and-Poet-by-Pauli-Murray.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.