Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6a5e8fd658df43…

MALICIOUS

PDF

16.8 KB Created: 2019-08-02 07:36:37 +01:00 Authoring application: mPDF 5.7
MD5: 80d232f6f48743a4b65266b663b2a41a SHA-1: 9e603e9d1925628869d8fe38a3cb044fd6da8eb6 SHA-256: 9c6a5e8fd658df43463090508a7a0ff7b2f677d2b3ec60284bcebbf4fa077ae5
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The primary purpose appears to be directing users to a domain hosting numerous documents, potentially for SEO manipulation or to distribute further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730739732732736733/Cherokee-Talisman-by-David-Michael-Harding.pdf
    • http://cefasfese.4pu.com/3739731732733736/Going-Bare-by-John-David-Harding.pdf
    • http://cefasfese.4pu.com/2731731730737735/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/4737732731731735/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/1736735733736733/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/1735732734738739/The-Sapphire-Talisman-Talisman-2-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/2732731739731730/The-Onyx-Talisman-Talisman-3-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/1738731737738737/Lover-s-Talisman-Talisman-Bay-1-by-Ashleigh-Raine.pdf
    • http://cefasfese.4pu.com/7738733733736739/The-Talisman-Chronicles-Boxed-Set-The-Vampire-Diaries-The-Talisman-Chronicles-1-3-by-Mandy-Balde.pdf
    • http://cefasfese.4pu.com/7738733733737733/The-Talisman-Chronicles-Volume-Three-The-Vampire-Diaries-The-Talisman-Chronicles-3-by-Mandy-Balde.pdf
    • http://cefasfese.4pu.com/1730739732734735737/The-Talisman-Chronicles-The-Talisman-Chronicles-1-6-by-T-M-Franklin.pdf
    • http://cefasfese.4pu.com/5731732733738734/Cherokee-by-Jean-Echenoz.pdf
    • http://cefasfese.4pu.com/3735730731734734/Cherokee-Mist-by-Bill-Nitopi.pdf
    • http://cefasfese.4pu.com/2732735739736739/Return-to-Cherokee-by-Harvey-Mendez.pdf
    • http://cefasfese.4pu.com/2733732737739734/Cherokee-Dragon-by-Robert-J-Conley.pdf
    • http://cefasfese.4pu.com/4730730731734734/The-Owl-Who-Became-the-Moon-A-Cherokee-Story-by-Jonathan-London.pdf
    • http://cefasfese.4pu.com/1730732733736737739/The-Cherokee-Herbal-Native-Plant-Medicine-from-the-Four-Directions-by-J-T-Garrett.pdf
    • http://cefasfese.4pu.com/9734730738737/Sequoyah-The-Cherokee-Man-Who-Gave-His-People-Writing-by-James-Rumford.pdf
    • http://cefasfese.4pu.com/2738737734733734/Trail-of-Tears-The-Rise-and-Fall-of-the-Cherokee-Nation-by-John-Ehle.pdf
    • http://cefasfese.4pu.com/5731733735738733/The-Cherokee-Struggle-to-Maintain-Identity-in-the-17th-and-18th-Centuries-by-William-R-Reynolds-Jr-.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.