Malicious PDF — malware analysis report

Static analysis result for SHA-256 98f091b622aeda65…

MALICIOUS

PDF

18.5 KB Created: 2020-03-18 16:56:07 +00:00 Authoring application: mPDF 5.7
MD5: ff20e373c30f0a2a4768af627866ce37 SHA-1: f98ffeafd6164440a53407065cad0dda2e76652a SHA-256: 98f091b622aeda6580c6a37d61855c1cf10ff22f07b659e95d7faa6238ea5ce0
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents on the domain 'ieuicufioao.myhome.cx'. This is indicative of an SEO poisoning or link farm attack pattern. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a mass external PDF link farm. No scripts were extracted from this sample. The primary IOCs are the numerous URLs hosted on the suspicious domain.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/2554554550555554/Angel-Evolution-The-Evolution-Trilogy-1-by-David-Estes.pdf
    • http://ieuicufioao.myhome.cx/4550557555559553/Evolution-Z-Stufe-Zwei-Evolution-Z---Zombie-Apokalypse-2-by-David-Bourne.pdf
    • http://ieuicufioao.myhome.cx/9554553556555/Icons-of-Evolution-Science-or-Myth-Why-Much-of-What-We-Teach-About-Evolution-Is-Wrong-by-Jonathan-Wells.pdf
    • http://ieuicufioao.myhome.cx/4554558553553557/Refuting-Evolution-A-Handbook-for-Students-Parents-and-Teachers-Countering-the-Latest-Arguments-for-Evolution-by-Jonathan-Sarfati.pdf
    • http://ieuicufioao.myhome.cx/4558552550558557/The-Evolution-Series-Omnibus-Edition-The-Evolution-1-3-by-S-A-Huchton.pdf
    • http://ieuicufioao.myhome.cx/3552559553551559/Angel-s-Evolution-by-T-A-Chase.pdf
    • http://ieuicufioao.myhome.cx/3553553553555550/Evolution-Evolution-1-by-Lissa-Kasey.pdf
    • http://ieuicufioao.myhome.cx/8555559551551558/Populations-Species-and-Evolution-An-Abridgment-of-Animal-Species-and-Evolution-by-Ernst-W-Mayr.pdf
    • http://ieuicufioao.myhome.cx/4552550559559558/Hybrid-The-Evolution-Trilogy-1-by-Vanessa-Wester.pdf
    • http://ieuicufioao.myhome.cx/2556559551559557/Werelock-Evolution-The-Complete-Trilogy-by-Hettie-Ivers.pdf
    • http://ieuicufioao.myhome.cx/4552551552550555/The-Evolution-Trilogy-Hybrid-Complications-amp-Return-by-Vanessa-Wester.pdf
    • http://ieuicufioao.myhome.cx/2558552551555/The-Klamath-Knot-Explorations-of-Myth-and-Evolution-by-David-Rains-Wallace.pdf
    • http://ieuicufioao.myhome.cx/7552559552551559/Pensions-in-Europe-European-Pensions-The-Evolution-of-Pension-Policy-at-National-and-Supranational-Level-by-David-Natali.pdf
    • http://ieuicufioao.myhome.cx/2559551552557559/Hex-The-Evolution-3-by-S-A-Huchton.pdf
    • http://ieuicufioao.myhome.cx/1551553553558550556/And-God-Said-Let-There-Be-Evolution-by-Steve-Henn.pdf
    • http://ieuicufioao.myhome.cx/3553551556553559/The-End-of-Evolution-by-Peter-D-Ward.pdf
    • http://ieuicufioao.myhome.cx/1554550554558551/Evolution-by-Linda-Gamlin.pdf
    • http://ieuicufioao.myhome.cx/4558557556559559/The-Evolution-of-God-by-Robert-Wright.pdf
    • http://ieuicufioao.myhome.cx/9554551551555/The-Evolution-Man-Or-How-I-Ate-My-Father-by-Roy-Lewis.pdf
    • http://ieuicufioao.myhome.cx/1551554558553550/Evolution-E-2-by-Kate-Wrath.pdf
    • http://ieuicufioao.myhome.cx/8555559551551558/Populations-Species-and-Evolution-An-Abridgment-of-Animal-Species-and-Evolu

Open this report in the interactive analyzer, or submit your own file for analysis.