Malicious PDF — malware analysis report

Static analysis result for SHA-256 a7147ef4d949827f…

MALICIOUS

PDF

16.9 KB Created: 2019-08-02 07:36:44 +01:00 Authoring application: mPDF 5.7
MD5: 775c3c37aa367f8fdb1929ae9857a3a7 SHA-1: d1c0fd4961a183a6ae26c7a4b579903b49b5ec16 SHA-256: a7147ef4d949827fa60d306bf752fbb4d302ea26c18155b69dc47533b33f0c0f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, forming a link farm. This is indicative of a SEO poisoning or spamming attack, aiming to drive traffic to external sites. The ClamAV detection further supports its malicious nature. No scripts were extracted, and the document body was heavily obfuscated, preventing deeper analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Malware.Agent-9988901-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Malware.Agent-9988901-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1733731730732734/Hellwatch-Pilot-Episode-by-Larime-Taylor.pdf
    • http://cefasfese.4pu.com/1730736737733739730/Hula-Hoop-oder-wie-man-frau-endlich-Lust-auf-Sex-bekommt-Episode-1---Der-hinkende-Pilot-Liebessatire-by-Sandra-Seico.pdf
    • http://cefasfese.4pu.com/8731733730732739/Star-Wars-Episode-1-Journal-Pack--Anakin-Skywalker-and-Queen-Amidala-Star-Wars-Episode-1-Journal-by-Todd-Strasser.pdf
    • http://cefasfese.4pu.com/3736735736730734/Spiritual-Secret-of-Hudson-Taylor-by-Howard-Taylor.pdf
    • http://cefasfese.4pu.com/1731733731735730737/The-Other-Pilot-by-Ed-Baldwin.pdf
    • http://cefasfese.4pu.com/1731733731736736732/Fighter-Pilot-by-McScotch.pdf
    • http://cefasfese.4pu.com/1731733731735734732/Marty-and-the-Pilot-by-Harper-Fox.pdf
    • http://cefasfese.4pu.com/8733736735738/The-Last-Pilot-by-Benjamin-Johncock.pdf
    • http://cefasfese.4pu.com/1731733731735730735/Jungle-Pilot-by-Russell-T-Hitt.pdf
    • http://cefasfese.4pu.com/2734730738734735/The-Pilot-s-Wife-by-Anita-Shreve.pdf
    • http://cefasfese.4pu.com/1731733731737731730/Pilot-amp-Huxley-The-Next-Adventure-by-Dan-McGuiness.pdf
    • http://cefasfese.4pu.com/3734734736738738/Remembrances-for-a-Certain-Pilot-by-Koroku-Inumura.pdf
    • http://cefasfese.4pu.com/4736738738737735/Torchship-Pilot-by-Karl-K-Gallagher.pdf
    • http://cefasfese.4pu.com/7730739738732738/The-Whole-Works-of-the-Right-Rev-Jeremy-Taylor-Worthy-Communicant-Supplement-of-Sermons-Collection-of-Offices-by-Jeremy-Taylor.pdf
    • http://cefasfese.4pu.com/5735736731734733/Veuve-Taylor-by-Henrietta-Taylor.pdf
    • http://cefasfese.4pu.com/4734736732738733/Stuka-Pilot-by-Hans-Ulrich-Rudel.pdf
    • http://cefasfese.4pu.com/2737733730737731/Daring-the-Pilot-Men-of-Marietta-3-by-Jeannie-Moon.pdf
    • http://cefasfese.4pu.com/3739734736737732/Dagger-American-Fighter-Pilot-by-Sam-J-D-Hunt.pdf
    • http://cefasfese.4pu.com/5739733734730732/The-Hiroshima-Pilot-by-William-Bradford-Huie.pdf
    • http://cefasfese.4pu.com/6739732736737736/Uplift-A-Pilot-s-Journey-by-Grant-Corriveau.pdf
    • http://cefasfese.4pu.com/273473

Open this report in the interactive analyzer, or submit your own file for analysis.