Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a611a1c081f07d0…

MALICIOUS

PDF

21.3 KB Created: 2020-01-02 06:04:48 +00:00 Authoring application: mPDF 5.7
MD5: 53c6610a53688874e3b838c70c312327 SHA-1: 4abb534c74f6de560268e7cb57da53107ef2b2ca SHA-256: 9a611a1c081f07d018e6cb58b70157a13a12a4000246dd9650ca05b0a807e433
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily corrupted and unreadable, the presence of numerous links suggests a malicious intent, possibly for SEO manipulation or to direct users to malicious sites. The links themselves point to book titles, which could be a lure. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9735732731731738/Niemand-rettet-sich-allein-Roman-by-Margaret-Mazzantini.pdf
    • http://cefasfese.4pu.com/1731737735734735733/Der-Mann-Der-Sich-In-Den-Mond-Verliebte-Roman-by-Tom-Spanbauer.pdf
    • http://cefasfese.4pu.com/9736733737738730/Kindle-Unlimited---Lohnt-sich-das-Wie-Sie-als-Leser-oder-Autor-das-Beste-f-r-sich-rausholen-by-Markus-Tillmanns.pdf
    • http://cefasfese.4pu.com/1731739733733730738/An-sich-Sein-F-r-sich-Sein-und-der-Andere-bei-Sartre-und-seine-Bez-ge-auf-Hegel-by-Christian-Walter.pdf
    • http://cefasfese.4pu.com/9738736732735734/Niemand-die-me-ziet-by-Simone-Grimberg.pdf
    • http://cefasfese.4pu.com/1730732735738737738/Wessobrunnische-Marianische-Fama-in-Sich-Haltend-Die-Weitere-Merckw-Rdigiste-Begebenheiten-Welche-Sich-In--Und-Um-Das-Jahr-1745-Ereignet-Bey-Der-Hoch--Und-Weltber-Hmten-Haupt-Bruderschafft-Der-Unbefleckten-Emf-Ngnu-Mariae-Der-Wunderth-Tigen-by-Veremund-Eisvogel.pdf
    • http://cefasfese.4pu.com/9738739732738737/Kommissar-Fr-hlich-Nur-ein-Niemand-by-Stephan-Hagenow.pdf
    • http://cefasfese.4pu.com/1730732734733735737/Der-Wendepunkt---Seine-Liebe-rettet-ihr-Leben-by-Teresa-Nagengast.pdf
    • http://cefasfese.4pu.com/1731737739730735739/Bullen-und-Schweine-Kommissar-Wolf-rettet-die-Welt-by-Josef-Kelnberger.pdf
    • http://cefasfese.4pu.com/9732738731737735/Wie-we-zijn-wanneer-we-denken-dat-er-niemand-kijkt-by-Christian-Rudder.pdf
    • http://cefasfese.4pu.com/1731732734737736739/Udo-Das-Neunte-Rentier-Wie-Udo-Weihnachten-in-Gefahr-Bringt-Und-Dann-Doch-Noch-Die-Bescherung-Rettet-by-Ole-Comet.pdf
    • http://cefasfese.4pu.com/8736736734736730/Allein-mit-allen-Gedankenbuch-by-Botho-Strau-.pdf
    • http://cefasfese.4pu.com/8736737731734731/Ich-aber-schlafe-allein-by-Helga-Hegewisch.pdf
    • http://cefasfese.4pu.com/8737733735737734/Allein-mit-dem-Feind-by-Alexandra-Stefanie-H-ll.pdf
    • http://cefasfese.4pu.com/9735732731730732/Daniel-und-Esther-allein-in-Rom-by-Hans-Dieter-St-ver.pdf
    • http://cefasfese.4pu.com/6735736731730733/Allein-um-die-Welt-segeln-Sailing-alone-around-the-World-by-Joshua-Slocum.pdf
    • http://cefasfese.4pu.com/9739730738734736/Atemlos---Beim-Sterben-ist-jeder-allein-by-Michael-E-Vieten.pdf
    • http://cefasfese.4pu.com/8736739734733733/Allein-in-der-Wand-National-Geographic-Taschenbuch-40599-by-Alex-Honnold.pdf
    • http://cefasfese.4pu.com/9733736733730733/Der-kleine-F-rst-65---Adelsroman-Sch-ne-Braut-allein-by-Viola-Maybach.pdf
    • http://cefasfese.4pu.com/9733734734734733/Ein-Rockstar-kommt-selten-allein-Lost-in-Stereo-3-by-Teresa-Sporrer.pdf
    • http://cefasfese.4pu.com/173073273573

Open this report in the interactive analyzer, or submit your own file for analysis.