Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a936637b20bdee3…

MALICIOUS

PDF

19.6 KB Created: 2020-03-18 18:08:47 +00:00 Authoring application: mPDF 5.7
MD5: 479d919cd82577f5b211b875a0c6c176 SHA-1: 6f4abeb220e8dec6647e2775608a431db3b1df13 SHA-256: 4a936637b20bdee3667b2013ac15eb2e6915f8e0c4f010ab759cd85a9ad54451
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates this is likely for SEO manipulation or to redirect users to potentially malicious content. No scripts were extracted, and the document body was largely unreadable, limiting further analysis of specific user lures. The URLs themselves are the most significant IOCs.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://weisncio.myhome.cx/2623628627621624/London-Under-London-A-Subterranean-Guide-by-Richard-Trench.pdf
    • http://weisncio.myhome.cx/3622624621622621/London-s-Hidden-Rivers-A-walker-s-guide-to-the-subterranean-waterways-of-London-by-David-Fathers.pdf
    • http://weisncio.myhome.cx/3622623621629625/The-Life-of-London-4-Volume-Set-Elizabeth-s-London-Dr-Johnson-s-London-Restoration-London-and-Victorian-London-by-Liza-Picard.pdf
    • http://weisncio.myhome.cx/1621625629621621622/White-Fang-by-Jack-London-a-Novel-John-Griffith-Jack-London-by-Jack-London.pdf
    • http://weisncio.myhome.cx/7621623620621621/Sherlock-Holmes-s-London-Following-the-Footsteps-of-London-s-Master-Detective-by-Tsukasa-Kobayashi.pdf
    • http://weisncio.myhome.cx/8626628626628621/Die-Schatten-von-London-In-Aeternum-Shades-of-London-3-by-Maureen-Johnson.pdf
    • http://weisncio.myhome.cx/3622622625621629/The-London-Scene-Six-Essays-on-London-Life-by-Virginia-Woolf.pdf
    • http://weisncio.myhome.cx/1621625622625/The-Luckiest-Lady-in-London-The-London-Trilogy-1-by-Sherry-Thomas.pdf
    • http://weisncio.myhome.cx/6627624624623626/London-By-Pub-Pub-Walks-Around-Historic-London-by-Ted-Bruning.pdf
    • http://weisncio.myhome.cx/7629624627628621/Not-The-One-London-Lovers-4-Lost-in-London-1-by-Amy-Daws.pdf
    • http://weisncio.myhome.cx/3622622628621626/Shakespeare-s-London-on-5-Groats-a-Day-by-Richard-Tames.pdf
    • http://weisncio.myhome.cx/1625625627620624/After-London-or-Wild-England-by-Richard-Jefferies.pdf
    • http://weisncio.myhome.cx/8629625628621/Haunted-Sites-of-London-by-Richard-Holland.pdf
    • http://weisncio.myhome.cx/3622624623628621/London-s-Strangest-Tales-Extraordinary-But-True-Tales-from-Over-a-Thousand-Years-of-London-s-History-by-Tom-Quinn.pdf
    • http://weisncio.myhome.cx/5627624622625628/The-Call-of-the-Wild---Jack-London---Original-Book---ANNOTATED-by-Jack-London.pdf
    • http://weisncio.myhome.cx/2622629624622627/London-Lace-Complete-Series-London-Lace-1-5-by-Catou-Martine.pdf
    • http://weisncio.myhome.cx/3622624621622623/365-Reasons-to-be-Proud-to-Be-a-Londoner-Magical-Moments-in-London-s-History-by-Richard-Happer.pdf
    • http://weisncio.myhome.cx/1620623621623624626/The-Bespokist-Society-Guide-to-London-by-Jeremy-Liebster.pdf
    • http://weisncio.myhome.cx/1628625629629/Cadogan-Guide-London-Paris-by-Andrew-Gumbel.pdf
    • http://weisncio.myhome.cx/1620620621621629628/The-City-of-London-A-Masonic-Guide-by-Yasha-Beresiner.pdf
    • http://weisncio.myhome.cx/8626628626628621/Die-Schatten-von-London-In-Aeternum-Shades-of-London-3-by-Maureen-Johnson.pd

Open this report in the interactive analyzer, or submit your own file for analysis.