Malicious PDF — malware analysis report

Static analysis result for SHA-256 93b226719201c7a8…

MALICIOUS

PDF

18.4 KB Created: 2019-05-02 05:03:44 +01:00 Authoring application: mPDF 5.7
MD5: 499c9d204305d8220d8fb5ae08b82814 SHA-1: cb42f43c90ac919fb6bf7bd3c48aede50d2e444a SHA-256: 93b226719201c7a8bee9549f3aca22bf3af67509166b2f3cef4dea8935921ebf
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious due to a critical heuristic firing for a large number of external PDF links. The document body contains numerous URLs pointing to external PDF files hosted on 'cefasfese.4pu.com'. While some individual URLs were marked as benign, the sheer volume and the nature of the 'PDF_SEO_LINK_FARM' heuristic suggest a malicious intent, likely to distribute further malware or conduct phishing operations. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9735737731734/Altered-Visions-The-Art-Of-Vincent-Chong-by-Vincent-Chong.pdf
    • http://cefasfese.4pu.com/1732731735737735/The-Concubine-s-Children-by-Denise-Chong.pdf
    • http://cefasfese.4pu.com/1730737738732731/Burning-Rice-by-Eileen-Chong.pdf
    • http://cefasfese.4pu.com/1739736736739732/Egg-on-Mao-The-Story-of-an-Ordinary-Man-Who-Defaced-an-Icon-and-Unmasked-a-Dictatorship-by-Denise-Chong.pdf
    • http://cefasfese.4pu.com/5739733734735731/Vincent-Survivor-Vincent-Series-1-by-O-L-Eggert.pdf
    • http://cefasfese.4pu.com/3732731734737732/You-Are-a-Unicorn-The-Fun-Creative-Journal-for-Everyone-by-Vincent-Vincent.pdf
    • http://cefasfese.4pu.com/6735737731734738/Quelques-Nouvelles-terrifiantes-Le-D-ner-des-bustes---La-Hache-d-or---L-Auberge-pouvantable---Le-No-l-du-petit-Vincent-Vincent---Not-Olympe---La-Femme-au-collier-de-velours-by-Gaston-Leroux.pdf
    • http://cefasfese.4pu.com/1732731730737733/Northern-Dancer-How-An-Undersized-Horse-Gave-A-Nation-Heart-And-Chgd-The-Sport-O-by-Kevin-Chong.pdf
    • http://cefasfese.4pu.com/1731735732739738735/Parisian-Surreal-The-Interiors-of-Vincent-Darre-by-Vincent-Darre.pdf
    • http://cefasfese.4pu.com/1730734732730735735/The-Letters-of-Vincent-van-Gogh-902-pieces-ebook-by-Vincent-van-Gogh.pdf
    • http://cefasfese.4pu.com/2739732737739731/The-Vincent-Boys-Collection-The-Vincent-Boys-1-2-by-Abbi-Glines.pdf
    • http://cefasfese.4pu.com/5730731731736739/The-Vincent-Boys-The-Vincent-Boys-1-by-Abbi-Glines.pdf
    • http://cefasfese.4pu.com/3735731738738/The-Vincent-Boys-The-Vincent-Boys-1-by-Abbi-Glines.pdf
    • http://cefasfese.4pu.com/3730730739730737/The-Vincent-Boys-The-Vincent-Boys-1-by-Abbi-Glines.pdf
    • http://cefasfese.4pu.com/6736732733737731/Complete-Letters-of-Vincent-Van-Gogh-by-Vincent-van-Gogh.pdf
    • http://cefasfese.4pu.com/3735738730730/The-Letters-of-Vincent-van-Gogh-by-Vincent-van-Gogh.pdf
    • http://cefasfese.4pu.com/2733731739733732/They-by-Vincent-Hobbes.pdf
    • http://cefasfese.4pu.com/8730735732738734/The-Crocodile-by-Vincent-Eri.pdf
    • http://cefasfese.4pu.com/5733731733732736/The-Anonymous-Man-by-Vincent-L-Scarsella.pdf
    • http://cefasfese.4pu.com/4732735730731735/Second-Coming-by-Vincent-Bivona.pdf
    • http://cefasfese.4pu.com/6735737731734738/Quelques-Nouvelles-terrifiantes-Le-D-ner-des-bustes---La-Hache-d-or---L-Auberge-pouvantable---Le-No-l-du-petit-Vincent-Vincent---Not-Olymp

Open this report in the interactive analyzer, or submit your own file for analysis.