Malicious PDF — malware analysis report

Static analysis result for SHA-256 9eafe1cd0c1a4edd…

MALICIOUS

PDF

20.7 KB Created: 2020-02-13 18:23:59 +00:00 Authoring application: mPDF 5.7
MD5: 48f7769685199d6736f6c43b244070a7 SHA-1: 7245cc52e7f8d1a4cd67654e81891a1943a23a55 SHA-256: 9eafe1cd0c1a4edd5d3d8b6aacad5ab4075b8dd856f8918b17553798261b05ca
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a heuristic firing for a link farm, with 26 external PDF links embedded. The primary purpose appears to be SEO manipulation or to serve as a distribution point for other malicious content. No scripts were extracted from this sample, limiting further analysis of direct execution capabilities.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/152455248524452415246/The-Magic-Goes-Away-Collection-The-Magic-Goes-Away-The-Magic-May-Return-More-Magic-by-Larry-Niven.pdf
    • http://lwoscmobook.myhome.cx/252455244524552415245/Harnessing-Fire-Magic-A-Witch-s-Guide-to-Elemental-Magic-Elemental-Witchcraft-and-Magic-Book-2-by-Viivi-James.pdf
    • http://lwoscmobook.myhome.cx/252455245524852455244/Harnessing-Air-Magic-A-Witch-s-Guide-to-Elemental-Magic-Elemental-Witchcraft-and-Magic-Book-1-by-Viivi-James.pdf
    • http://lwoscmobook.myhome.cx/352425245524352405249/Darkness-Rises-Age-Of-Magic---A-Kurtherian-Gambit-Series-The-Rise-of-Magic-6-by-C-M-Raymond.pdf
    • http://lwoscmobook.myhome.cx/152495246524352415240/Trace-of-Magic-Diamond-City-Magic-1-by-Diana-Pharaoh-Francis.pdf
    • http://lwoscmobook.myhome.cx/552425240524052485243/The-Transformations-of-Magic-Illicit-Learned-Magic-in-the-Later-Middle-Ages-and-Renaissance-by-Frank-Klaassen.pdf
    • http://lwoscmobook.myhome.cx/352485248524052465245/Shades-of-Light-Age-Of-Magic---A-Kurtherian-Gambit-Series-The-Hidden-Magic-Chronicles-1-by-Justin-Sloan.pdf
    • http://lwoscmobook.myhome.cx/1524052445249524652415248/The-Colors-of-Magic-Magic-The-Gathering-Anthology-4-by-Jess-Lebow.pdf
    • http://lwoscmobook.myhome.cx/152415242524852495245/The-Best-Kind-of-Magic-Windy-City-Magic-1-by-Crystal-Cestari.pdf
    • http://lwoscmobook.myhome.cx/55248524752435244/A-Darker-Shade-of-Magic-Shades-of-Magic-1-by-V-E-Schwab.pdf
    • http://lwoscmobook.myhome.cx/352495246524852435248/Burning-Magic-Shadow-Magic-3-by-Joshua-Khan.pdf
    • http://lwoscmobook.myhome.cx/352465246524752425249/A-Darker-Shade-of-Magic-Shades-of-Magic-1-by-V-E-Schwab.pdf
    • http://lwoscmobook.myhome.cx/15244524352465248/Dragon-Magic-The-Magic-Series-4-by-Andre-Norton.pdf
    • http://lwoscmobook.myhome.cx/352405242524652405249/Magic-Bitter-Magic-Sweet-by-Charlie-N-Holmberg.pdf
    • http://lwoscmobook.myhome.cx/152425244524252495249/The-Magic-Shop-Shadow-Magic-1-by-Justin-Swapp.pdf
    • http://lwoscmobook.myhome.cx/452435245524952405245/Magic-Gone-Wild-Bottled-Magic-3-by-Judi-Fennell.pdf
    • http://lwoscmobook.myhome.cx/95248524352495240/The-Magic-Touch-The-Magic-Triangle-Trilogy-3-by-P-K-Silverson.pdf
    • http://lwoscmobook.myhome.cx/152495249524552445246/Midsummer-Magic-Magic-Trilogy-1-by-Catherine-Coulter.pdf
    • http://lwoscmobook.myhome.cx/252495249524352435245/Shadow-Magic-Sisters-of-Magic-1-by-Donna-Grant.pdf
    • http://lwoscmobook.myhome.cx/15244524552445243/Steel-Magic-The-Magic-Series-1-by-Andre-Norton.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.