Malicious PDF — malware analysis report

Static analysis result for SHA-256 82fc9a532af7d733…

MALICIOUS

PDF

16.5 KB Created: 2019-04-30 04:16:02 +01:00 Authoring application: mPDF 5.7
MD5: 78bfb3a635d702074ac91d5b38f36a91 SHA-1: 8c519824551498a594cb5aa11efd668ccc86ec96 SHA-256: 82fc9a532af7d73360cc123ed94a8546eb2e0b3ec0ef6364e9fc250d50f9edac
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on the `xiixmcuin.linkpc.net` domain. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a link farm intended to manipulate search engine results or distribute content, which can be a precursor to malicious activity. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/4203202207201204/Black-Dog-Bannon-s-Gym-1-by-Cat-Grant.pdf
    • http://xiixmcuin.linkpc.net/4203202207201206/Takedown-Bannon-s-Gym-2-by-Cat-Grant.pdf
    • http://xiixmcuin.linkpc.net/5203209203209207/Defaming-Steve-Bannon-How-Reactionary-Liberals-Lied-and-Ridiculed-Stephen-K-Bannon-the-Counselor-to-the-President-of-the-United-States-of-America-Pamphlet-by-Richard-West.pdf
    • http://xiixmcuin.linkpc.net/2209209200203208/Rescued-Black-Light-6-by-Livia-Grant.pdf
    • http://xiixmcuin.linkpc.net/2209209200202202/Roulette-Redux-Black-Light-7-by-Livia-Grant.pdf
    • http://xiixmcuin.linkpc.net/2206207201202208/Nowhere-to-Run-by-Jeanne-Bannon.pdf
    • http://xiixmcuin.linkpc.net/6200208206208208/White-Women-s-Christ-and-Black-Women-s-Jesus-Feminist-Christology-and-Womanist-Response-by-Jacquelyn-Grant.pdf
    • http://xiixmcuin.linkpc.net/2202201209203203/Invisible-by-Jeanne-Bannon.pdf
    • http://xiixmcuin.linkpc.net/1202207201203208/Senseless-Confidential-by-Martin-Bannon.pdf
    • http://xiixmcuin.linkpc.net/2203202207209202/Farscape-Scorpius-Vol-1-by-Rockne-S-O-39-Bannon.pdf
    • http://xiixmcuin.linkpc.net/2209205208209201/Good-Stuff-A-Reminiscence-of-My-Father-Cary-Grant-by-Jennifer-Grant.pdf
    • http://xiixmcuin.linkpc.net/2205201205204208/Grant-s-Final-Victory-Ulysses-S-Grant-s-Heroic-Last-Year-by-Charles-Bracelen-Flood.pdf
    • http://xiixmcuin.linkpc.net/2204209208200209/The-Exchange-Beautiful-Monster-1-by-Jeanne-Bannon.pdf
    • http://xiixmcuin.linkpc.net/1207209206203203/Honor-Bannon-Brothers-2-by-Janet-Dailey.pdf
    • http://xiixmcuin.linkpc.net/1206208202203205/The-Iron-Wyrm-Affair-Bannon-amp-Clare-1-by-Lilith-Saintcrow.pdf
    • http://xiixmcuin.linkpc.net/1201209204200205207/Aramos---Ein-Sal-Derwish-Roman-in-zwei-Teilen-by-Blake-O-39-Bannon.pdf
    • http://xiixmcuin.linkpc.net/3206207206202208/The-Iron-Wyrm-Affair-Bannon-amp-Clare-1-by-Lilith-Saintcrow.pdf
    • http://xiixmcuin.linkpc.net/1201200205208200204/Gone-and-BZRK-Series-Michael-Grant-Collection-9-Books-Set-by-Michael-Grant.pdf
    • http://xiixmcuin.linkpc.net/1201200205208200203/michael-grant-collection-gone-and-bzrk-series-9-books-set-by-Michael-Grant.pdf
    • http://xiixmcuin.linkpc.net/6209205209207205/Reminiscences-of-Ulysses-S-Grant-by-Ulysses-S-Grant.pdf
    • http://xiixmcuin.linkpc.net/6200208206

Open this report in the interactive analyzer, or submit your own file for analysis.