Malicious PDF — malware analysis report

Static analysis result for SHA-256 916c76f141fa0016…

MALICIOUS

PDF

16.3 KB Created: 2019-11-09 22:16:48 +00:00 Authoring application: mPDF 5.7
MD5: 6883ec6da66423202e3f6ccf3eab4248 SHA-1: 46b20c77b5c3dbb511849ab55a07a2750b93cfb4 SHA-256: 916c76f141fa00166dd9e16ba5cc2013e18a57d24299a6cd52f171d1b3e02811
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a link farm, containing numerous embedded URLs. These URLs, while individually marked as benign, collectively suggest a tactic to manipulate search engine results or drive traffic to a specific domain. The primary attack pattern involves leveraging these links for SEO manipulation or as part of a broader traffic-driving scheme. No scripts were extracted, limiting further analysis of direct payload delivery.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4731739733730736/An-Improper-Holiday-by-K-A-Mitchell.pdf
    • http://cefasfese.4pu.com/3730730737734730/Improper-Longings-Improper-2-by-Dawn-Ryder.pdf
    • http://cefasfese.4pu.com/8730730735735739/A-Holiday-Warrior-Holiday-Vermont-Book-6-by-Heather-Lire.pdf
    • http://cefasfese.4pu.com/1730731737732737737/Haley-s-Hangdog-Holiday-Holiday-Inc-2-by-Tamie-Dearen.pdf
    • http://cefasfese.4pu.com/8730730735733734/A-Holiday-Christmas-Holiday-Vermont-2-5-by-Heather-Lire.pdf
    • http://cefasfese.4pu.com/4738736739734735/Merry-Mitchell-Affair-The-Mitchell-Healy-Family-3-5-by-Jennifer-Foor.pdf
    • http://cefasfese.4pu.com/5730735737737736/A-Most-Improper-Magick-by-Stephanie-Burgis.pdf
    • http://cefasfese.4pu.com/2739738735732734/An-Improper-Proposal-by-Patricia-Cabot.pdf
    • http://cefasfese.4pu.com/4737731730732736/An-Improper-Lover-by-Maggi-Andersen.pdf
    • http://cefasfese.4pu.com/2733735734733737/Improper-Pleasure-by-Charlotte-Featherstone.pdf
    • http://cefasfese.4pu.com/2739739736734735/Love-With-An-Improper-Demon-by-Darcy-Varga.pdf
    • http://cefasfese.4pu.com/6735739736734731/Improper-Christmas-Nights-by-Amanda-McCabe.pdf
    • http://cefasfese.4pu.com/7733731731730733/Honorable-Doctor-Improper-Arrangement-by-Mary-Nichols.pdf
    • http://cefasfese.4pu.com/2738730739738738/The-Improper-Life-of-Bezellia-Grove-by-Susan-Gregg-Gilmore.pdf
    • http://cefasfese.4pu.com/2730734733737738/The-Highlander-s-Princess-Bride-The-Improper-Princesses-3-by-Vanessa-Kelly.pdf
    • http://cefasfese.4pu.com/6735730737736735/A-Dangerous-Libertine-An-Improper-Aristocrat-The-Maiden-s-Abduction-by-Deb-Marlowe.pdf
    • http://cefasfese.4pu.com/1731735732731731738/Joni-Mitchell-The-Complete-Poems-and-Lyrics-by-Joni-Mitchell.pdf
    • http://cefasfese.4pu.com/4735733731736735/The-Mitchell-Family-Series-Box-Set-Mitchell-Family-1-4-5-by-Jennifer-Foor.pdf
    • http://cefasfese.4pu.com/6735730730730731/An-Improper-Bride-Elliot-amp-Annabelle-2-Billionaires-Brides-of-Convenience-4-by-Nadia-Lee.pdf
    • http://cefasfese.4pu.com/3731737730730731/The-Most-Improper-Miss-Sophie-Valentine-Sydney-Dovedale-1-by-Jayne-Fresina.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.