Malicious PDF — malware analysis report

Static analysis result for SHA-256 48d8ed5f51b42b2d…

MALICIOUS

PDF

18.1 KB Created: 2019-05-01 13:08:33 +01:00 Authoring application: mPDF 5.7
MD5: 85cddc2ce32c2bd1ecc04ebd21bd2a99 SHA-1: ca2c8a88e3fa6374be409fd5e9356fa934e39162 SHA-256: 48d8ed5f51b42b2df5330e77f1bec0d4f32cfc811170c4acc565affc1e07e37c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily corrupted, the presence of numerous links suggests a malicious intent, possibly for SEO manipulation or to distribute malware. The links themselves point to various book titles, which could be a lure. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/3203200204204/A-Scanner-Darkly-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/4207201200204202/A-Scanner-Darkly-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1205204209202200/The-Collected-Works-of-Philip-K-Dick-11-Science-Fiction-Stories-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1203208207205205/The-Collected-Stories-of-Philip-K-Dick-2-We-Can-Remember-it-for-You-Wholesale-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/3202208204209205/The-Short-Happy-Life-of-the-Brown-Oxford-and-Other-Classic-Stories-The-Collected-Stories-of-Philip-K-Dick-Vol-1-Vol-1-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/4202209207204205/The-Collected-Stories-of-Philip-K-Dick-5-Vols-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1200201200203203207/Articles-on-Dystopian-Novels-Including-Animal-Farm-a-Clockwork-Orange-the-Trial-Fahrenheit-451-Left-Behind-the-Three-Stigmata-of-Palmer-Eldritch-Time-Out-of-Joint-a-Scanner-Darkly-Ubik-Do-Androids-Dream-of-Electric-Sheep-by-Hephaestus-Books.pdf
    • http://xiixmcuin.linkpc.net/5206207209201203/Philip-K-Dick-s-Electric-Dreams-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1201201206206204209/The-Philip-K-Dick-Collection-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/2206209204208202/Born-Darkly-Darkly-Madly-Duet-1-by-Trisha-Wolfe.pdf
    • http://xiixmcuin.linkpc.net/1201204209205202/Eye-in-the-Sky-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1207205203205201/The-Zap-Gun-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1201203207200209208/The-Defenders-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/4206208207205207/VALIS-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/8207202202206209/Oh-to-Be-A-Blobel-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1203208205201209/The-Simulacra-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/3202204206208204/Ubik-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/3202206209206206/The-Eyes-Have-It-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/4201200200205/Now-Wait-for-Last-Year-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/3202206201202205/Piper-in-the-Woods-by-Philip-K-Dick.pdf
    • http://xiixmcuin.linkpc.net/1200201200203203207/Articles-o

Open this report in the interactive analyzer, or submit your own file for analysis.