Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd00683cdf04d997…

MALICIOUS

PDF

16.5 KB Created: 2020-03-19 20:48:13 +00:00 Authoring application: mPDF 5.7
MD5: 4ff0abd1847c18967e1932cbc7f1bed9 SHA-1: f3cc88e3b8eeb32bf51ae6a6dff3b5abebdfe463 SHA-256: bd00683cdf04d9977d2ac1e1b06e4f331fba9e557b402688e50849708cfdfc0c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' confirms this behavior. The primary intent appears to be directing users to a domain hosting a large collection of potentially harmful content, rather than executing a direct payload from this file.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/1816081658162816281668164/Decayed-Ten-Years-Of-Point-Horror-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/68161816481678161/The-Lifeguard-Point-Horror-3-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181638163816881608167/Trick-or-Treat-Point-Horror-6-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/981648162816381628166/Fatal-Secrets-Point-Horror-24-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/1816081658162816281658166/Point-Horror-Collection-3-April-Fools-The-Waitress-The-Snowman-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/981648162816481638163/Scarecrow-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/281608168816281668169/Help-Wanted-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/481698168816481618164/The-Mall-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/981648162816481628166/The-Locker-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/48167816481608160/The-House-Next-Door-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181638165816681648164/Sin-and-Salvation-The-Unseen-4-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181618166816981608167/It-Begins-The-Unseen-1-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181638165816681678160/Blood-Brothers-The-Unseen-3-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/1816081658162816281658167/Evil-on-the-Bayou-Twilight-Where-Darkness-Begins-21-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/281648165816081678162/The-Harvest-Buffy-the-Vampire-Slayer-Novelizations-2-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181648167816081668168/Spirit-Walk-Walk-1-2-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181618165816981648167/The-Unseen-The-Unseen-1-2-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181618168816481658164/The-Unseen-2-The-Unseen-3-4-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/481638166816881608162/The-Angel-Chronicles-Vol-2-The-Angel-Chronicles-2-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/181698164816081668160/Buffy-the-Vampire-Slayer-Buffy-the-Vampire-Slayer-Novelizations-1-by-Richie-Tankersley-Cusick.pdf
    • http://owlaokopdf.myhome.cx/48167816481608160/The-House-Next-Door-by-Richie-Tankersley-Cu

Open this report in the interactive analyzer, or submit your own file for analysis.