Malicious PDF — malware analysis report

Static analysis result for SHA-256 504526e712d6d016…

MALICIOUS

PDF

18.0 KB Created: 2019-04-30 11:22:41 +01:00 Authoring application: mPDF 5.7
MD5: 8518e0f08e2ea32ca74e3f555b08a543 SHA-1: 378b36b36d178ce863a75559a4b1939f7a64d993 SHA-256: 504526e712d6d016349c71108d9708db952f6a6c92e379257694b1529c80eeaf
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or to distribute malware. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, with the dominant host being 'cefasfese.4pu.com'. While the document body is heavily obfuscated, the presence of these links and the heuristic firing strongly suggest a malicious intent to redirect users to potentially harmful content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/3737737733738734/Five-Go-To-Mystery-Moor-Book-13-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/4737731730731/Five-Go-to-Mystery-Moor-Famous-Five-13-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/9737738734733736/The-Enid-Blyton-Book-Of-Brownies-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/2734733732735730/The-Enid-Blyton-Book-of-Fairies-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/2734734737730734/Snicker-The-Brownie-And-Other-Stories-Enid-Blyton-s-Popular-Rewards-Series-I-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/1738730737736730/The-Sneezing-Dog-And-Other-Stories-Enid-Blyton-s-Popular-Rewards-Series-Iv-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/3735737734730738/Enid-Blyton-s-Malory-Towers-6-Books-Collection-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/2737734737738735/The-Naughtiest-Girl-Collection-Enid-Blyton-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/8737734735739/Five-Have-a-Mystery-to-Solve-Famous-Five-20-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/3737733731734731/The-Mystery-of-the-Pantomime-Cat-The-Five-Find-Outers-7-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/1738730739737739/The-Mystery-of-the-Burnt-Cottage-The-Five-Find-Outers-1-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/6738736731731/The-Mystery-of-the-Vanished-Prince-The-Five-Find-Outers-9-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/3737733733734735/The-Mystery-of-Holly-Lane-The-Five-Find-Outers-11-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/6733738734737/The-Mystery-of-the-Strange-Messages-The-Five-Find-Outers-14-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/9737738737730735/The-Mystery-of-Banshee-Towers-The-Five-Find-Outers-15-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/6731738731731/The-Mystery-of-the-Invisible-Thief-The-Five-Find-Outers-8-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/2733734736738732/The-Rilloby-Fair-Mystery-Barney-Mysteries-2-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/3736735732737737/An-Enid-Blyton-Collection-The-Enchanted-Wood-The-Magic-Faraway-Tree-And-The-Folk-Of-The-Faraway-Tree-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/9737738736735739/Looking-For-Enid-The-Mysterious-And-Inventive-Life-Of-Enid-Blyton-by-Duncan-McLaren.pdf
    • http://cefasfese.4pu.com/2734734733739733/Secret-Seven-Mystery-The-Secret-Seven-9-by-Enid-Blyton.pdf
    • http://cefasfese.4pu.com/8737734735739/Five-Have-a-Mystery-to-Solve-Famous-Five-20-by-Enid-Blyton.pd

Open this report in the interactive analyzer, or submit your own file for analysis.