Malicious PDF — malware analysis report

Static analysis result for SHA-256 9414eef82ca910c0…

MALICIOUS

PDF

19.7 KB Created: 2019-11-10 00:17:44 +00:00 Authoring application: mPDF 5.7
MD5: 51b43a81bd7a26d91c20c04c004a0fc0 SHA-1: bd235040fd3a2ac41a66e3cf05459c88d5c7b80e SHA-256: 9414eef82ca910c0f3ad738a57484f91411bf1c63c43f2efdb16053566f4aa3d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for a PDF_SEO_LINK_FARM, indicating a large number of embedded external links. While many of these links were individually classified as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/6734733738733731/Kabouter-korsakov-in-de-puree-by-Philip-Maes.pdf
    • http://cefasfese.4pu.com/9737730736737731/Africa-Unchained-The-Blueprint-for-Africa-s-Future-by-George-B-N-Ayittey.pdf
    • http://cefasfese.4pu.com/4735737734735738/Nick-s-Time-Out-Nick-s-Awakening-2-by-Simon-Strange.pdf
    • http://cefasfese.4pu.com/8737737731737732/New-Light-on-Dark-Africa-Being-the-Narrative-of-the-German-Emin-Pasha-Expedition-Its-Journeyings-and-Adventures-Among-the-Native-Tribes-of-Eastern-Equatorial-Africa-the-Gallas-Massais-Wasukuma-Etc-on-the-Lake-Baringo-and-the-Victoria-Nyanza-by-Carl-Peters.pdf
    • http://cefasfese.4pu.com/2738735734736739/The-Secret-Life-of-the-Love-Song-and-The-Flesh-Made-Word-Two-Lectures-by-Nick-Cave-by-Nick-Cave.pdf
    • http://cefasfese.4pu.com/1731733730730738733/Canada-s-First-Railway-The-Champlain-And-St-Lawrence-By-Nick-And-Helma-Mika-by-Nick-Mika.pdf
    • http://cefasfese.4pu.com/8737732735730733/The-Silk-Road-Nick-Rowan-and-Christopher-Herwig-by-Nick-Rowan.pdf
    • http://cefasfese.4pu.com/3733735735/The-Second-Life-of-Nick-Mason-Nick-Mason-1-by-Steve-Hamilton.pdf
    • http://cefasfese.4pu.com/1730730736738736732/The-Nick-Nolte-Handbook---Everything-You-Need-to-Know-about-Nick-Nolte-by-Skyler-Koch.pdf
    • http://cefasfese.4pu.com/5734733739735732/Nick-Newton-Is-Not-a-Genius-Nick-Newton-1-by-S-E-M-Ishida.pdf
    • http://cefasfese.4pu.com/3733732733730/Out-of-Africa-by-Isak-Dinesen.pdf
    • http://cefasfese.4pu.com/1731735733734736737/The-First-World-War-in-Africa-by-Hew-Strachan.pdf
    • http://cefasfese.4pu.com/6730739731734736/Why-Rimbaud-Went-to-Africa-by-David-Lerner.pdf
    • http://cefasfese.4pu.com/7733738736732738/Dances-of-Africa-by-Michel-Huet.pdf
    • http://cefasfese.4pu.com/9739731738733735/This-Is-South-Africa-by-Peter-Borchert.pdf
    • http://cefasfese.4pu.com/7731732733733735/Africa-Volume-2-by-lis-e-Reclus.pdf
    • http://cefasfese.4pu.com/9735739730738/On-Foot-Through-Africa-by-Ffyona-Campbell.pdf
    • http://cefasfese.4pu.com/4730737736734736/I-Dreamed-of-Africa-by-Kuki-Gallmann.pdf
    • http://cefasfese.4pu.com/4731730731731731/A-Good-Man-in-Africa-by-William-Boyd.pdf
    • http://cefasfese.4pu.com/8735731736739737/A-Dream-of-Africa-by-Camara-Laye.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.