Malicious PDF — malware analysis report

Static analysis result for SHA-256 78dfc7efe977cab7…

MALICIOUS

PDF

22.6 KB Created: 2019-05-02 01:43:49 +01:00 Authoring application: mPDF 5.7
MD5: 84c75e2bcc55694ec23d0f27eba3b368 SHA-1: 3164855a5db30a41bfae69043a3bcc87652bc4a9 SHA-256: 78dfc7efe977cab715d5863b9382a9d66e8c5e001ccde84bbe3fb23e37f0f91e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to host malicious content. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with a dominant host of 'xiixmcuin.linkpc.net'. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to direct users to potentially harmful content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/8201201201202206/Late-Essays-2006-2017-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/8201201200207201/The-Best-American-Essays-2006-by-Lauren-Slater.pdf
    • http://xiixmcuin.linkpc.net/8201201201207204/Creationists-Selected-Essays-1993-2006-by-E-L-Doctorow.pdf
    • http://xiixmcuin.linkpc.net/1200209209207209206/The-Hashemites-in-the-Modern-Arab-World-Essays-in-Honour-of-the-Late-Professor-Uriel-Dann-by-Asher-Susser.pdf
    • http://xiixmcuin.linkpc.net/6202208202200202/Saratov-Fall-Meeting-2006-Laser-Physics-And-Photonics-Spectroscopy-And-Molecular-Modeling-Vii-Saratov-Fall-Meeting-2006-26-29-September-2006-Saratov-Russia-by-Vladimir-L-Derbov.pdf
    • http://xiixmcuin.linkpc.net/1201202206209205203/2006-International-Conference-on-Communication-Technology-Proceedings-Nov-27-30-2006-Guilin-China-by-Zhongguo-Dian.pdf
    • http://xiixmcuin.linkpc.net/1201202206208200207/Wireless-Algorithms-Systems-and-Applications-12th-International-Conference-Wasa-2017-Guilin-China-June-19-21-2017-Proceedings-by-Liran-Ma.pdf
    • http://xiixmcuin.linkpc.net/7201206206202204/Artificial-Intelligence-and-Soft-Computing-16th-International-Conference-Icaisc-2017-Zakopane-Poland-June-11-15-2017-Part-II-by-Leszek-Rutkowski.pdf
    • http://xiixmcuin.linkpc.net/1201202206208200206/Knowledge-Science-Engineering-and-Management-First-International-Conference-KSEM-2006-Guilin-China-August-5-8-2006-Proceedings-by-Jerome-Lang.pdf
    • http://xiixmcuin.linkpc.net/5205206202207202/Unity-2017-Game-AI-programming---Third-Edition-Bring-your-games-to-life-by-creating-intelligent-entites-using-Unity-2017-by-Ray-Barrera.pdf
    • http://xiixmcuin.linkpc.net/1200209201208202207/Database-and-XML-Technologies-4th-International-XML-Database-Symposium-Xsym-2006-Seoul-Korea-September-10-11-2006-Proceedings-by-Sihem-Amer-Yahia.pdf
    • http://xiixmcuin.linkpc.net/5206207200206200/Best-wallpaper-2017-Best-wallpaper-2017-21-Book-23-by-CMT-cuong.pdf
    • http://xiixmcuin.linkpc.net/3205203205202/How-Late-it-Was-How-Late-by-James-Kelman.pdf
    • http://xiixmcuin.linkpc.net/3204209204201202/How-Late-it-Was-How-Late-by-James-Kelman.pdf
    • http://xiixmcuin.linkpc.net/3209200204205201/Youth-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/2201202207203201/Disgrace-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/1204200208206201/Youth-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/3206201206203/Slow-Man-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/8208200207206/Disgrace-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/4204206204201/Disgrace-by-J-M-Coetzee.pdf
    • http://xiixmcuin.linkpc.net/1201202206209205203/2006-International-Conference-on-Communication-Te