Malicious PDF — malware analysis report

Static analysis result for SHA-256 80cbba8a8cb104e8…

MALICIOUS

PDF

16.9 KB Created: 2019-04-30 11:22:33 +01:00 Authoring application: mPDF 5.7
MD5: 812b43e2b44645ffc4c6eef16c27a655 SHA-1: fac0a655cf20cb77c71366d156754640718ff40a SHA-256: 80cbba8a8cb104e8384c7c68978a7d02578aafbf185e4dd35301237687edc85a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as a dropper by ClamAV. Static analysis revealed a large number of embedded URLs, forming a link farm. These URLs, while currently flagged as benign, are likely part of a redirection chain designed to lead the user to a malicious payload or phishing page. The PDF structure itself is heavily obfuscated, suggesting an attempt to evade detection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7159363-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7159363-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2739734733735736/Minnie-and-Moo-Go-Dancing-by-Denys-Cazet.pdf
    • http://cefasfese.4pu.com/2739733732738738/Minnie-And-Moo-And-The-Potato-From-Planet-X-With-Cd-by-Denys-Cazet.pdf
    • http://cefasfese.4pu.com/2739734735732739/The-Attack-of-the-Easter-Bunnies-by-Denys-Cazet.pdf
    • http://cefasfese.4pu.com/2739734731736735/Minnie-and-Moo-Save-the-Earth-With-Cassette-by-Denys-Cazet.pdf
    • http://cefasfese.4pu.com/2739734736734734/Elvis-The-Rooster-Almost-Goes-To-Heaven-I-Can-Read-Level-3-by-Denys-Cazet.pdf
    • http://cefasfese.4pu.com/1739732730735734/A-Night-of-Living-Dangerously-by-Jennie-Lucas.pdf
    • http://cefasfese.4pu.com/1737736735730738/Night-of-the-Living-Dead-by-John-A-Russo.pdf
    • http://cefasfese.4pu.com/3733730733735731/Night-of-the-Living-Dead-by-John-A-Russo.pdf
    • http://cefasfese.4pu.com/1730736730739734731/Morning-Noon-Night-A-Way-of-Living-by-Soho-House.pdf
    • http://cefasfese.4pu.com/3738732736739730/Night-of-the-Living-Cuddle-Bunnies-by-Jonathan-Rosen.pdf
    • http://cefasfese.4pu.com/1738737738738738/The-Living-Night-Part-One-Vampire-Thriller-1-by-Jack-Conner.pdf
    • http://cefasfese.4pu.com/2738734736737733/Night-of-the-Living-Rerun-Buffy-the-Vampire-Slayer-Season-1-2-by-Arthur-Byron-Cover.pdf
    • http://cefasfese.4pu.com/1731730731735731731/Night-of-the-Living-Shark-Daniel-M-Pinkwater-s-Melvinge-of-the-Megaverse-Book-1-by-David-Bischoff.pdf
    • http://cefasfese.4pu.com/1730730732736736/Violence-Begets-by-P-T-Denys.pdf
    • http://cefasfese.4pu.com/8734737732737730/13-rue-du-Pendu-by-Anton-Denys.pdf
    • http://cefasfese.4pu.com/1739732737732730/Violence-Begets-by-P-T-Denys.pdf
    • http://cefasfese.4pu.com/1730737739731738/The-Child-of-Denys-by-Nicole-Gillette.pdf
    • http://cefasfese.4pu.com/7731733730738731/Inside-Image-SQL-by-Denys-Beauchemin.pdf
    • http://cefasfese.4pu.com/8732733737737734/The-World-s-Greatest-Traveller-Ibn-Battouta-by-Denys-Johnson-Davies.pdf
    • http://cefasfese.4pu.com/8738739733738731/Living-in-DC-An-Insider-s-Guide-How-to-Get-a-Job-and-Make-the-Most-of-Living-in-the-Nation-s-Capital-by-Kate-McFadyen.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.