Malicious PDF — malware analysis report

Static analysis result for SHA-256 975c33e3d4bb06cb…

MALICIOUS

PDF

19.1 KB Created: 2020-03-16 21:52:11 +00:00 Authoring application: mPDF 5.7
MD5: 3fbd0010e77a305dbb2be4a9bc605775 SHA-1: e616f28181739006d12bccec4e6f08d2de2d11f8 SHA-256: 975c33e3d4bb06cbb2076b1431adde53889a75352a89612dceb0a3b9350a5c83
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles, suggesting a potential SEO manipulation scheme or a distribution point for further malicious content. No scripts were extracted from this sample. The primary attack pattern involves redirecting users to external resources.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://calistazz.myhome.cx/7868869865864/Hang-in-There-Bozo-The-Ruby-Redfort-Emergency-Survival-Guide-for-Some-Tricky-Predicaments-Ruby-Redfort-0-5-by-Lauren-Child.pdf
    • http://calistazz.myhome.cx/1867869861868865/Take-Your-Last-Breath-Ruby-Redfort-2-by-Lauren-Child.pdf
    • http://calistazz.myhome.cx/4860860869868/Take-Your-Last-Breath-Ruby-Redfort-2-by-Lauren-Child.pdf
    • http://calistazz.myhome.cx/4866861863861862/Catch-Your-Death-Ruby-Redfort-3-by-Lauren-Child.pdf
    • http://calistazz.myhome.cx/1860863863863869864/Professional-Ruby-Series-Writing-Efficient-Ruby-Code-by-Stefan-Kaes.pdf
    • http://calistazz.myhome.cx/1868861865865864/Lauren-s-Barbarian-Icehome-1-by-Ruby-Dixon.pdf
    • http://calistazz.myhome.cx/8862862864860862/Ruby-on-Rails-3-Tutorial-Learn-Rails-by-Example-Addison-Wesley-Professional-Ruby-Series-by-Michael-Hartl.pdf
    • http://calistazz.myhome.cx/2866861865862866/The-Boyfriend-List-15-Guys-11-Shrink-Appointments-4-Ceramic-Frogs-and-Me-Ruby-Oliver-Ruby-Oliver-1-by-E-Lockhart.pdf
    • http://calistazz.myhome.cx/4862861861864860/The-Twistedly-True-Tale-of-Ruby-Hood-Ruby-Hood-1-by-Stephanie-Greenhalgh.pdf
    • http://calistazz.myhome.cx/1861865866860866861/Ruby-Red-Shoes-Goes-to-London-Ruby-Red-Shoes-Book-3-by-Kate-Knapp.pdf
    • http://calistazz.myhome.cx/7864864864860864/A-Town-Called-Ruby-Prairie-Ruby-Prairie-1-by-Annette-Smith.pdf
    • http://calistazz.myhome.cx/3861869863865865/The-Ruby-Iyer-Diaries-Ruby-Iyer-Series-0-5-by-Laxmi-Hariharan.pdf
    • http://calistazz.myhome.cx/4861868868863868/Ruby-Celeste-and-the-Ghost-Armada-Ruby-Celeste-1-by-Nicholas-J-Ambrose.pdf
    • http://calistazz.myhome.cx/1860864860860867/Ruby-Blue-Ruby-Blue-1-by-Julie-Cassar.pdf
    • http://calistazz.myhome.cx/1860869869862864863/The-Lost-Ruby-The-Lost-Child-by-Christoph-von-Schmid.pdf
    • http://calistazz.myhome.cx/1861866869861862869/Pokemon-Pinball-Ruby-amp-Sapphire-Prima-s-Official-Strategy-Guide-by-Prima-Publishing.pdf
    • http://calistazz.myhome.cx/3865866865866860/Tricky-Wisdom-Year-I-Tricky-1-by-Camryn-Eyde.pdf
    • http://calistazz.myhome.cx/1860869861864860860/The-Starting-School-Survival-Guide-Everything-You-Need-to-Know-When-Your-Child-Starts-School-by-Sarah-Ebner.pdf
    • http://calistazz.myhome.cx/4864869867865861/Ruby-by-Ann-Hood.pdf
    • http://calistazz.myhome.cx/3860866868866868/Eidolon-by-Ruby-Duvall.pdf
    • http://calistazz.myhome.cx/8862862864860862/Ruby-on-Rails-3-Tutorial-Learn-Rails-by-Example-Addison-Wesley-Professional-R

Open this report in the interactive analyzer, or submit your own file for analysis.