Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c332760f60b143a…

MALICIOUS

PDF

14.7 KB Created: 2019-05-03 05:07:52 +01:00 Authoring application: mPDF 5.7
MD5: 6621b1fcfe9b519a3a32a0272f41d915 SHA-1: 9551394bd7d07b4d2081f524e58dbcba02091a0b SHA-256: 4c332760f60b143a7fefd0d8fb1e83de94a7ad4c3bddb7ae0a7cb41fa46a2cec
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to serve as a distribution point for further malicious content. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu
    • http://cefasfese.4pu.com/5735736732730731/The-Fall-of-the-House-of-Usher-Der-Untergang-des-Hauses-Usher-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1730738735730737731/The-Fall-of-the-House-of-Usher-and-Other-Tales-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/2736733733732732/Edgar-Allan-Poe-s-The-Fall-of-the-House-of-Usher-by-Robert-Lanier.pdf
    • http://cefasfese.4pu.com/4735738739737738/The-Fall-of-the-House-of-Usher-The-Pit-amp-the-Pendulum-Other-Tales-of-Mystery-amp-Imagination-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1731736730731739735/The-Complete-Works-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/3732737738735730/The-Collected-Tales-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/4735737738737737/Edgar-Allan-Poe-s-Annotated-Poems-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/8739733733731738/Edgar-Allan-Poe-s-15-Illustrated-Poems-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/6732733737739730/Edgar-Allan-Poe-Stories-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/5732733733732735/Tales-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1730738733739732738/Tales-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/6732733737738739/The-Poems-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1731739734732734733/The-Tales-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1730733735733735/An-Edgar-Allan-Poe-Reader-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/3738734730739/Tales-of-Edgar-Allan-Poe-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/2732739738737732/Morella-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/6734736739735/The-Pit-and-the-Pendulum-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/1732735731736737/The-Spectacles-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/9731734733732730/El-cuervo-by-Edgar-Allan-Poe.pdf
    • http://cefasfese.4pu.com/2738730734735731/Eleanora-by-Edgar-Allan-Poe.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.