Malicious PDF — malware analysis report

Static analysis result for SHA-256 500d68fa06124c8b…

MALICIOUS

PDF

16.3 KB Created: 2020-03-17 03:56:49 +00:00 Authoring application: mPDF 5.7
MD5: 8eac312fb188923d3336aebbc0565077 SHA-1: 7e7dd878aca28bbc0da849bb6f9611d184251ab3 SHA-256: 500d68fa06124c8b7079edb7b00e1c624590fd280db0d55eaeabc4d7d4459631
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for a link farm, containing numerous embedded URLs. These URLs point to PDF documents hosted on a suspicious domain, suggesting a tactic to distribute content or lure users to malicious sites. No scripts were extracted from this sample, and the document body primarily consists of obfuscated data and repeated URLs.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/781678163816381668161/Dubliners-the-definitive-text-restoring-Joyce-s-manuscript-style-and-later-corrections-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/781658160816681668161/Dubliners-By-James-Joyce-Illustrated-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/681698169816281668162/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/38162816481678169/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/481628161816881678168/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/1816081648169816681628163/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/681668162816881658167/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/681658169816781698168/Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/381638162816881638166/Dubliners-Part-II-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/181688165816681648168/The-Dead-and-Other-Stories-from-Dubliners-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/1816181698161816381668164/Dubliners-Macmillan-Collector-s-Library-Book-60-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/181608165816181628169/Dubliners-A-Portrait-of-the-Artist-As-a-Young-Man-Chamber-Music-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/38169816381668165/My-Brother-s-Keeper-James-Joyce-s-Early-Years-by-Stanislaus-Joyce.pdf
    • http://owlaokopdf.myhome.cx/781608161816781678162/Ulysses-Illustrated-Featuring-a-fascinating-photo-diary-of-Joyce-s-Dublin-and-a-dynamic-table-of-all-18-chapters-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/381618164816581678164/Gilda-Joyce-The-Ghost-Sonata-Gilda-Joyce-3-by-Jennifer-Allison.pdf
    • http://owlaokopdf.myhome.cx/381618164816181668166/Gilda-Joyce-The-Bones-of-the-Holy-Gilda-Joyce-5-by-Jennifer-Allison.pdf
    • http://owlaokopdf.myhome.cx/381618164816581698162/Gilda-Joyce-The-Ladies-of-the-Lake-Gilda-Joyce-2-by-Jennifer-Allison.pdf
    • http://owlaokopdf.myhome.cx/18163816481608163/Gilda-Joyce-Psychic-Investigator-Gilda-Joyce-1-by-Jennifer-Allison.pdf
    • http://owlaokopdf.myhome.cx/381638162816881648168/A-Mother-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/581668160816081638161/Ulysses-by-James-Joyce.pdf
    • http://owlaokopdf.myhome.cx/181608165816181628169/Dubliners-A-Portrait-of-the-Artist-As-a-Young-Man-Chamber-Mu

Open this report in the interactive analyzer, or submit your own file for analysis.