Malicious PDF — malware analysis report

Static analysis result for SHA-256 799c6182841937a9…

MALICIOUS

PDF

18.2 KB Created: 2020-03-18 11:27:48 +00:00 Authoring application: mPDF 5.7
MD5: 71796455c4c6d4635cd50c7920162e1d SHA-1: 05e2fff28e8a574584db25c1764df1ebfbc2e2e9 SHA-256: 799c6182841937a98ba3182dc09fe10fe3e8d565373410fe8bd293ecad3765db
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to a single suspicious domain, indicative of an SEO poisoning or link farm attack. The URLs themselves are structured like book titles, suggesting a lure to attract users searching for specific content. No scripts were extracted, and the document body was not readable, but the heuristic firings strongly suggest a malicious intent to redirect users to potentially harmful content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://easckaolp.myhome.cx/4849840848846844/Medieval-Indian-Society-And-Culture-Advanced-Study-In-The-History-Of-Medieval-India-Vol-Iii-by-J-L-Mehta.pdf
    • http://easckaolp.myhome.cx/5842842844843846/Making-Agreements-in-Medieval-Catalonia-Power-Order-and-the-Written-Word-1000-1200-Cambridge-Studies-in-Medieval-Life-and-Thought-Fourth-Series-by-Adam-J-Kosto.pdf
    • http://easckaolp.myhome.cx/8849849848847840/Roman-Hellenism-and-The-New-Testament-by-Frederick-C-Grant.pdf
    • http://easckaolp.myhome.cx/8849849847845843/Classical-Anatolia-The-Glory-of-Hellenism-by-Harry-Brewster.pdf
    • http://easckaolp.myhome.cx/8849849848841843/Wound-of-Greece-Studies-in-Neo-Hellenism-by-Philip-Sherrard.pdf
    • http://easckaolp.myhome.cx/4849847841843841/Boy-in-a-Band-by-Lisa-Loomis.pdf
    • http://easckaolp.myhome.cx/7846841846845/The-Eye-of-the-Painter-by-Andrew-Loomis.pdf
    • http://easckaolp.myhome.cx/7844841847840840/The-Golden-Crucifix-A-Matthew-Cordwainer-Medieval-Mystery-Matthew-Cordwainer-Medieval-Mysteries-Book-1-by-Joyce-Lionarons.pdf
    • http://easckaolp.myhome.cx/8849849848841848/The-Significance-of-Yavneh-and-Other-Essays-in-Jewish-Hellenism-by-Shaye-J-D-Cohen.pdf
    • http://easckaolp.myhome.cx/8849849847845841/Silent-Urns-Romanticism-Hellenism-Modernity-by-David-Ferris.pdf
    • http://easckaolp.myhome.cx/8849849848846844/Liberal-Judaism-and-Hellenism-and-Other-Essays-by-Claude-Goldsmid-Montefiore.pdf
    • http://easckaolp.myhome.cx/8849849847841840/Who-Needs-Greek-Contests-in-the-Cultural-History-of-Hellenism-by-Simon-Goldhill.pdf
    • http://easckaolp.myhome.cx/2849846847840/Short-Cut-to-Red-River-by-Noel-M-Loomis.pdf
    • http://easckaolp.myhome.cx/9844848845848843/Sinai-secret-The-by-Greg-Loomis.pdf
    • http://easckaolp.myhome.cx/7849847844845848/Hot-Ice-Jason-Peters-2-by-Gregg-Loomis.pdf
    • http://easckaolp.myhome.cx/8849849848846847/Boku-no-Hero-Academia-dj---24-Hour-Tramp-Stamp-Endurance-SEX-by-Hellenism.pdf
    • http://easckaolp.myhome.cx/2847842840847846/The-Sinking-of-Bethany-Ann-Crane-by-K-Kris-Loomis.pdf
    • http://easckaolp.myhome.cx/8845844843848840/Figure-Drawing-for-All-It-s-Worth-by-Andrew-Loomis.pdf
    • http://easckaolp.myhome.cx/6842846845848849/The-Poison-Secret-Lang-Reilly-7-by-Gregg-Loomis.pdf
    • http://easckaolp.myhome.cx/7849847844846841/Gates-of-Hades-Jason-Peters-1-by-Gregg-Loomis.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.