Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d7186d31db2a89b…

MALICIOUS

PDF

15.7 KB Created: 2020-03-20 00:06:27 +00:00 Authoring application: mPDF 5.7
MD5: 8ced1c172ed9990a217171892c0f9914 SHA-1: 1c316a6e13c26b3a27a36aa9167d6dde27647524 SHA-256: 9d7186d31db2a89bdff21fc6682b0f6f4d1727148c89ead1e89ff0d6e9aac06d
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external link farm, suggesting a spam or phishing campaign. The URLs are hosted on the domain kitasdyu.myhome.cx, which appears to be used for distributing these linked documents. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kitasdyu.myhome.cx/3877877870871873/Kidnapped-Sweet-Valley-High-13-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/2870871873874874/The-Wakefields-of-Sweet-Valley-Sweet-Valley-High-Magna-Editions-1-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/2870871873870876/The-Patmans-of-Sweet-Valley-Sweet-Valley-High-Magna-Editions-12-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876876871870/Nowhere-to-Run-Sweet-Valley-High-25-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876876870873/Showdown-Sweet-Valley-High-19-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876874871870/Memories-Sweet-Valley-High-24-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876876870877/Troublemaker-Sweet-Valley-High-47-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876876871873/The-New-Elizabeth-Sweet-Valley-High-63-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876874871873/Promises-Sweet-Valley-High-15-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876876871871/Taking-Sides-Sweet-Valley-High-31-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876873875870/When-Love-Dies-Sweet-Valley-High-12-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/9871876870875879/Hard-Choices-Sweet-Valley-High-43-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876874871871/Racing-Hearts-Sweet-Valley-High-9-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/1871877879875877879/Love-and-Death-in-London-Sweet-Valley-High-104-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/7875870871870/The-Halloween-War-Sweet-Valley-Kids-62-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/8875872874879/The-Big-Race-Sweet-Valley-Kids-37-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/1870875879875871879/It-Can-t-Happen-Here-Sweet-Valley-Twins-86-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/4876879876873874/Here-Comes-the-Bride-Sweet-Valley-University-20-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/1878871873873876/Sneaking-Out-Sweet-Valley-Twins-5-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/8874876879878/Get-the-Teacher-Sweet-Valley-Kids-46-by-Francine-Pascal.pdf
    • http://kitasdyu.myhome.cx/6879876873875870/When-Love-Dies-Sweet-Valley-High-12-by-Fr

Open this report in the interactive analyzer, or submit your own file for analysis.