Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0f254e1a9f98327…

MALICIOUS

PDF

13.2 KB Created: 2020-03-18 16:57:22 +00:00 Authoring application: mPDF 5.7
MD5: 6becd484abf2d70685e72989a7f3a6c7 SHA-1: cdce03268aefd495a91e671bb646e83c3b318817 SHA-256: b0f254e1a9f9832798ceb527e78b85b6f5738be4ca560fa455747a01a9722be2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links pointing to external PDF documents on the domain 'owlaokopdf.myhome.cx'. This behavior is indicative of a link farm or a mechanism to distribute malicious content indirectly. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate intent beyond the link farm.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/481608161816481648165/Finn-s-Car--a-kart-racer-spies-a-chance-Finn-s-Fast-Books-2-by-Serena-Schreiber.pdf
    • http://owlaokopdf.myhome.cx/581608161816081638160/One-Night-at-Finn-s-Finn-s-Pub-Romance-1-by-R-G-Alexander.pdf
    • http://owlaokopdf.myhome.cx/281668167816681658164/One-Wild-Finn-Wild-Irish-Kindle-Worlds-The-Finn-Factor-9-by-R-G-Alexander.pdf
    • http://owlaokopdf.myhome.cx/281668167816681608160/Finn-Fancy-Necromancy-Finn-Fancy-Necromancy-1-by-Randy-Henderson.pdf
    • http://owlaokopdf.myhome.cx/381638164816481678160/Looking-Back-by-Jay-Finn.pdf
    • http://owlaokopdf.myhome.cx/68167816581638161/Away-from-You-by-Melanie-Finn.pdf
    • http://owlaokopdf.myhome.cx/381638160816681608167/Away-From-You-by-Melanie-Finn.pdf
    • http://owlaokopdf.myhome.cx/38160816481668169/Elizabeth-s-War-by-D-L-Finn.pdf
    • http://owlaokopdf.myhome.cx/281658160816981698168/Finn-by-John-Blandly.pdf
    • http://owlaokopdf.myhome.cx/281678163816281618161/She-Thief-by-Daniel-Finn.pdf
    • http://owlaokopdf.myhome.cx/181698161816181658168/Finn-the-Wolfhound-by-A-J-Dawson.pdf
    • http://owlaokopdf.myhome.cx/381608169816081698160/The-XY-Factor-by-Scarlett-Finn.pdf
    • http://owlaokopdf.myhome.cx/481668162816881688163/The-Woman-in-the-Window-by-A-J-Finn.pdf
    • http://owlaokopdf.myhome.cx/181648165816081648166/Finn-by-Ahren-Sanders.pdf
    • http://owlaokopdf.myhome.cx/481698160816781608167/Finn-the-Wolfhound-by-A-J-Dawson.pdf
    • http://owlaokopdf.myhome.cx/78161816981688169/The-Woman-in-the-Window-by-A-J-Finn.pdf
    • http://owlaokopdf.myhome.cx/281628163816381658165/The-Thing-With-Finn-by-Tom-Kelly.pdf
    • http://owlaokopdf.myhome.cx/381638164816681668164/Beneath-the-Darkness-by-Jay-Finn.pdf
    • http://owlaokopdf.myhome.cx/381688165816181608165/In-My-Own-Words-by-Mickey-Finn.pdf
    • http://owlaokopdf.myhome.cx/281678167816781608161/Forever-in-One-Second-by-Finn-Marlowe.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.