Malicious PDF — malware analysis report

Static analysis result for SHA-256 46dd10e163d0ca41…

MALICIOUS

PDF

16.5 KB Created: 2019-11-09 22:55:11 +00:00 Authoring application: mPDF 5.7
MD5: 65fb5149f694a5a2de8ea84d96722d17 SHA-1: ae71936a043788201bce2682a8a47f58b2f203ad SHA-256: 46dd10e163d0ca4166b88baa0ee9bd4f8bea93a5e88cb9910bd959c83cf8826f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various book titles hosted on the same domain, suggesting a potential link farm or SEO poisoning attempt to drive traffic. No scripts were extracted, and the document body was unreadable, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/5730731736733732/In-the-High-Valley-Carr-Family-5-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/3735736732737736/What-Katy-Did-Carr-Family-1-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/1733735735730732/Clover-Carr-Family-4-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/9731738732735/What-Katy-Did-Carr-Family-1-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/6734734736736733/What-Katy-Did-at-School-Carr-Family-2-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/1730734730739736/What-Katy-Did-at-School-Carr-Family-2-by-Susan-Coolidge.pdf
    • http://cefasfese.4pu.com/4738739735731733/Sweet-Valley-High-Collection-Double-Love-Secrets-Playing-with-Fire-Sweet-Valley-High-1-3-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/5730733733730731/Sweet-Valley-Twins-Summer-Diaries-Collection-Elizabeth-Next-Stop-Jr-High-Jessica-Next-Stop-Jr-High-Sweet-Valley-Twins-Super-Edition-13-14-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/2730731733730736/The-Patmans-of-Sweet-Valley-Sweet-Valley-High-Magna-Editions-12-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/2731736732733733/Paradise-Valley-Virgin-River-7-by-Robyn-Carr.pdf
    • http://cefasfese.4pu.com/3730731731731731/Bound-by-the-Past-Lowell-High-School-1-by-Mari-Carr.pdf
    • http://cefasfese.4pu.com/6739736736731730/Nowhere-to-Run-Sweet-Valley-High-25-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/6739736736731732/Playing-for-Keeps-Sweet-Valley-High-49-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/6739736736730735/Say-Goodbye-Sweet-Valley-High-23-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/6739736736731733/The-New-Elizabeth-Sweet-Valley-High-63-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/6739736734731732/Crash-Landing-Sweet-Valley-High-20-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/2739732731730734/Beware-the-Wolfman-Sweet-Valley-High-106-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/6739736733730732/Dangerous-Love-Sweet-Valley-High-6-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/9736737738734737/Aftershock-Sweet-Valley-High-Super-Edition-12-by-Francine-Pascal.pdf
    • http://cefasfese.4pu.com/9739734737735/Death-Valley-by-Susan-Perly.pdf
    • http://cefasfese.4pu.com/5730733733730731/Sweet-Valley-Twins-Summer-Diaries-Collection-Elizabeth-Next-Stop-Jr-High-Jessica-Next-Stop-Jr-High-Sweet-Valley-Twins-Super-Edition-13-14-by-Fr

Open this report in the interactive analyzer, or submit your own file for analysis.