Malicious PDF — malware analysis report

Static analysis result for SHA-256 a97faa901a15852c…

MALICIOUS

PDF

14.1 KB Created: 2019-06-10 05:22:36 +01:00 Authoring application: mPDF 5.7
MD5: 5fe38d137a248aa5085a3ac74c0585e7 SHA-1: 3afc555da08e3381b9eca24545e658a190b63b8b SHA-256: a97faa901a15852c7fdc0b2597b9ee47ab6ef921135105dbb832bbd90517cdd5
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external websites. The heuristic 'PDF_SEO_LINK_FARM' indicates these links are likely part of a link farm, a common tactic for SEO manipulation or to distribute malicious content. The document body is heavily obfuscated, preventing a clear understanding of its direct user-facing purpose, but the link farm strongly suggests a malicious intent to redirect users. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4733734738733737/Dragon-s-Blood-Cruentus-Dragons-1-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3733730734730738/Daly-Way-Volume-One-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3733738732734739/Stealing-the-Bride-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/1737739737738733/One-for-the-Team-Daly-Way-4-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/2730736733731732/Boy-Toys-Circle-of-Three-2-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/4732733730738732/In-The-Dark-Silken-Threads-1-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/2730736732733736/Phantoms-Pleasure-Circle-of-Three-3-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3730730737737733/On-Your-Knees-Cress-Brothers-1-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/2730736732732734/Forgotten-Family-Circle-of-Three-4-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3730730737737735/All-Chained-Up-Cress-Brothers-2-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3732738736737739/Stocking-Full-of-Cole-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/3730730737737732/Gentle-Control-Cress-Brothers-4-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/2736730733731733/Mr-Smith-s-Whip-Taboo-Wishes-4-by-Brynn-Paulin.pdf
    • http://cefasfese.4pu.com/2733735739730734/Dragon-s-Blood-Pit-Dragons-1-by-Jane-Yolen.pdf
    • http://cefasfese.4pu.com/2735733733735730/A-Tale-of-Two-Dragons-Dragon-Kin-0-2-by-G-A-Aiken.pdf
    • http://cefasfese.4pu.com/4734736733731739/Dragon-Killer-Reckoning-of-Dragons-1-by-Rob-May.pdf
    • http://cefasfese.4pu.com/2739735734732730/Dragon-Song-Dragons-and-Visions-2-by-Jim-Murdoch.pdf
    • http://cefasfese.4pu.com/1731739736733731735/The-Dragon-s-Gem-Dragons-of-Grayhurst-1-by-Donna-Flynn.pdf
    • http://cefasfese.4pu.com/3737738738731732/Dragon-s-Devotion-Dragons-4-by-Willa-Okati.pdf
    • http://cefasfese.4pu.com/5738738730733733/Fated-for-the-Dragon-Lost-Dragons-2-by-Zoe-Chant.pdf
    • http://cefasfese.4pu.com/273373573973

Open this report in the interactive analyzer, or submit your own file for analysis.