Malicious PDF — malware analysis report

Static analysis result for SHA-256 84ebe5d85b4a13c1…

MALICIOUS

PDF

33.6 KB Created: 2019-04-30 03:15:23 +01:00 Authoring application: mPDF 5.7
MD5: 6f55c3bac04a83cad7bdd13640256e9c SHA-1: 7997cd323ebf45083f4d43436c488bd863355bf0 SHA-256: 84ebe5d85b4a13c13d8e58a970981c0ef5a162731b51ae58b142449fcfeee259
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing numerous embedded URLs. While most of these URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to lure users to external sites. No scripts were extracted, and the document body is heavily obfuscated, preventing a deeper analysis of the specific lure. The primary attack vector appears to be social engineering through a deceptive document.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1200200204201201207/Anthropologists-Approaching-Education-Papers-Presented-at-the-Symposium-Anthropology-of-Education-Held-at-the-Occasion-of-the-1981-Intercongress-of-t-by-A-Kater.pdf
    • http://xiixmcuin.linkpc.net/1201209200200203204/Anthropology-And-As-Education-Anthropology-Art-Architecture-and-Design-by-Tim-Ingold.pdf
    • http://xiixmcuin.linkpc.net/7206203207202208/The-Privatization-of-Education-A-Political-Economy-of-Global-Education-Reform-by-Antoni-Verger.pdf
    • http://xiixmcuin.linkpc.net/4201205206208204/Is-Everyone-Really-Equal-An-Introduction-to-Key-Concepts-in-Social-Justice-Education-Multicultural-Education-Series-by-Ozlem-Sensoy.pdf
    • http://xiixmcuin.linkpc.net/5206202206201204/D-mocratie-et-ducation-suivi-de-Exp-rience-et-ducation-by-John-Dewey.pdf
    • http://xiixmcuin.linkpc.net/5200203208202203/Education-for-Everyone-Agenda-for-Education-in-a-Democracy-by-John-I-Goodlad.pdf
    • http://xiixmcuin.linkpc.net/4200205200202/The-Education-of-Sebastian-The-Education-of-1-by-Jane-Harvey-Berrick.pdf
    • http://xiixmcuin.linkpc.net/6205208209206204/Exploring-Cross-National-Attraction-in-Education-Some-Historical-Comparisons-of-American-and-Chinese-Attraction-to-Japanese-Education-by-Jeremy-Rappleye.pdf
    • http://xiixmcuin.linkpc.net/7203207201202205/Iutam-Symposium-on-Micromechanics-of-Plasticity-and-Damage-of-Multiphase-Materials-Proceedings-of-the-Iutam-Symposium-Held-in-Sevres-Paris-France-29-August-1-September-1995-by-Andr-Pineau.pdf
    • http://xiixmcuin.linkpc.net/6200207203209206/The-Orator-s-Education-Books-11-12-The-Orator-s-Education-5-by-Marcus-Fabius-Quintilianus.pdf
    • http://xiixmcuin.linkpc.net/6200207203209207/The-Orator-s-Education-Books-6-8-The-Orator-s-Education-3-by-Marcus-Fabius-Quintilianus.pdf
    • http://xiixmcuin.linkpc.net/8203201200205202/Association-Ou-Organisme-Lie-A-L-Education-Maison-Familiale-Rurale-Association-Canadienne-D-Education-de-Langue-Francaise-Parsec-Planete-Sciences-Les-Petits-Debrouillards-La-3e-Voie-Board-of-European-Students-of-Technology-by-Source-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/8207203209207207/Vendel-Period-Studies-Transactions-of-the-Boat-Grave-Symposium-in-Stockholm-February-2-3-1981-by-Statens-Historiska-Museum.pdf
    • http://xiixmcuin.linkpc.net/1200205205207208206/Polymerization-Of-Heterocyclics-Papers-Presented-At-The-Xxiii-Iupac-Congress-by-Otto-Vogl.pdf
    • http://xiixmcuin.linkpc.net/7206203207209209/Les-Universites-Francaises-Au-Moyen-Age-Education-and-Society-in-the-Middle-Ages-and-Renaissance-Vol-7-Education-and-Society-in-the-Middle-Ages-and-Renaissance-Vol-7-by-Jacques-Verger.pdf
    • http://xiixmcuin.linkpc.net/1200208207204203200/Systems-Analysis-and-Simulation-I-Theory-and-Foundations-Proceedings-of-the-International-Symposium-Held-in-Berlin-September-12-16-1988-by-A-Sydow.pdf
    • http://xiixmcuin.linkpc.net/7201203205201205/Integrated-Aromatic-Medicine-Proceedings-from-the-First-International-Symposium-Held-in-Grasse-France-March-21-22-1998-by-Essential-Science-Publishing.pdf
    • http://xiixmcuin.linkpc.net/1201204208207208205/Symposium-on-Paramyloidoses-Symposium-Concernant-Les-Paramyloidoses-Symposium-Uber-Die-Paramyloidosen-Organized-by-the-Problem-Commission-of-Neurochemistry-of-the-World-Federation-of-Neurology-Antwerp-October-30-31-1960-by-W-Kra1-4cke.pdf
    • http://xiixmcuin.linkpc.net/7201206205206209/Swarm-and-Evolutionary-Computation-International-Symposium-Side-2012-Held-in-Conjunction-with-Icaisc-2012-Zakopane-Poland-April-29---May-3-2012-Proceedings-by-Leszek-Rutkowski.pdf
    • http://xiixmcuin.linkpc.net/6206206201201206/The-Education-of-Cyrus-by-Xenophon.pdf
    • http://xiixmcuin.linkpc.net/5206202206201204/D-mocratie-et-ducation-suivi-de-Exp-rience-et

Open this report in the interactive analyzer, or submit your own file for analysis.