Malicious PDF — malware analysis report

Static analysis result for SHA-256 888fe5b4722bfc66…

MALICIOUS

PDF

17.8 KB Created: 2019-05-03 05:52:57 +01:00 Authoring application: mPDF 5.7
MD5: 4f5494a6c594e8edb626d51e2f90accc SHA-1: 64c29040222d5fee1d30bbd7c2031ec2c99e4298 SHA-256: 888fe5b4722bfc66ac9e3c06ea57539b57dba2a819e479d57f96bad45dd8cd60
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF file contains a heuristic firing for a large number of embedded external links, suggesting a link farm or redirection tactic. While the document body is heavily obfuscated, the presence of numerous URLs pointing to external PDF files indicates a potential attempt to manipulate search engine results or lead users to malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1737730739732732/Tied-Up-In-Knotts-Braden-Security-1-by-Dale-Cadeau.pdf
    • http://cefasfese.4pu.com/3734734735730734/Tied-Up-Tied-Down-Rough-Riders-4-by-Lorelei-James.pdf
    • http://cefasfese.4pu.com/1737730730730738/Tied-Up-Tied-Down-Rough-Riders-4-by-Lorelei-James.pdf
    • http://cefasfese.4pu.com/3735732734730/The-Tied-Man-The-Tied-Man-1-by-Tabitha-McGowan.pdf
    • http://cefasfese.4pu.com/8735735736732737/Un-cadeau-tr-s-particulier-pour-No-l-by-Sasha-S-.pdf
    • http://cefasfese.4pu.com/3730733731730734/Dr-Dale-s-Zombie-Dictionary-The-A-Z-Guide-to-Staying-Alive-by-Dale-Seslick.pdf
    • http://cefasfese.4pu.com/7736737738732735/Embedded-Java-Security-Security-for-Mobile-Devices-by-Mourad-Debbabi.pdf
    • http://cefasfese.4pu.com/7734735737732731/Smart-Materials-for-Energy-Communications-and-Security-NATO-Science-for-Peace-and-Security-Series-by-Daoud-Mezzane.pdf
    • http://cefasfese.4pu.com/3733730738739735/St-Dale-St-Dale-1-by-Sharyn-McCrumb.pdf
    • http://cefasfese.4pu.com/6733734736736730/Dead-of-Winter-Lily-Dale-Mystery-3-amp-Lily-Dale-7-by-Wendy-Corsi-Staub.pdf
    • http://cefasfese.4pu.com/7739738731736733/Information-Security-Policies-Procedures-and-Standards-Guidelines-for-Effective-Information-Security-Management-by-Thomas-R-Peltier.pdf
    • http://cefasfese.4pu.com/1730735737735735737/Robert-Dale---Privatdetektiv---Ein-Fall-voller-Erotik-Robert-Dale-Privatdetektiv-1-by-Jack-Kowalski.pdf
    • http://cefasfese.4pu.com/1736731734733/The-Wall-Between-by-Anne-Braden.pdf
    • http://cefasfese.4pu.com/2737733734730732/The-Burning-A-Chapter-in-My-Life-by-Braden-Lloyd.pdf
    • http://cefasfese.4pu.com/3738734736736732/Anything-but-a-Gentleman-Rescued-from-Ruin-8-by-Elisa-Braden.pdf
    • http://cefasfese.4pu.com/2738738731733/Black-Sea-Gods-Chronicles-of-Fu-Xi-1-by-Brian-Braden.pdf
    • http://cefasfese.4pu.com/2736733735735735/Ferris-Braden-Beyond-the-Marius-Brothers-6-by-Joyee-Flynn.pdf
    • http://cefasfese.4pu.com/3736735732733735/Love-in-Reality-The-Blackjack-Quartet-1-by-Magdalen-Braden.pdf
    • http://cefasfese.4pu.com/1730733737730739732/The-Cost-of-Happiness-The-Blackjack-Quartet-2-by-Magdalen-Braden.pdf
    • http://cefasfese.4pu.com/4730732732730733/The-Kindling-Middle-School-Magic-1-by-Braden-Bell.pdf
    • http://cefasfese.4pu.com/6733734736736730/Dead-of-Winter-Li

Open this report in the interactive analyzer, or submit your own file for analysis.