Malicious PDF — malware analysis report

Static analysis result for SHA-256 beafe9db83c927a3…

MALICIOUS

PDF

15.2 KB Created: 2020-03-15 00:54:06 +00:00 Authoring application: mPDF 5.7
MD5: 8a9d980299b194f41f6112351a87905a SHA-1: 93a2cf72a3810a392de085d39fedaedb4696304e SHA-256: beafe9db83c927a33db68e5c57b27e0f400d591884ae6a34a5b57a2c88d26993
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, identified by the PDF_SEO_LINK_FARM heuristic. The document body confirms the presence of these links, which all point to the same domain, 'owlaokopdf.myhome.cx'. This suggests a link farm or SEO spam campaign, potentially used to distribute malicious content or drive traffic to malicious sites.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/281698165816781628166/Double-Cross-Alex-Cross-13-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/2816081618165/Cross-Justice-Alex-Cross-23-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/88166816581648167/Alex-Cross-s-Trial-Alex-Cross-15-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/78168816581658163/I-Alex-Cross-Alex-Cross-16-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/48161816481628163/Cat-and-Mouse-Alex-Cross-4-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/8816881658169/The-People-vs-Alex-Cross-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/281698160816281668160/Along-Came-a-Spider-Alex-Cross-1-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/381608167816781698166/Hope-to-Die-Alex-Cross-22-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/181678168816781638161/Merry-Christmas-Alex-Cross-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/48164816981658162/Violets-Are-Blue-Alex-Cross-7-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/881618166816881678162/Along-Came-a-Spider-Alex-Cross-Book-1-by-James-Patterson.pdf
    • http://owlaokopdf.myhome.cx/281618163816681628164/Double-Cross-The-Disillusionists-2-by-Carolyn-Crane.pdf
    • http://owlaokopdf.myhome.cx/481638164816581638165/Double-Cross-Noughts-amp-Crosses-4-by-Malorie-Blackman.pdf
    • http://owlaokopdf.myhome.cx/18166816781698164/Double-Cross-The-True-Story-of-the-D-Day-Spies-by-Ben-Macintyre.pdf
    • http://owlaokopdf.myhome.cx/181608161816181638166/Hitler-s-Cross-The-Revealing-Story-of-How-the-Cross-of-Christ-Was-Used-as-a-Symbol-of-the-Nazi-Agenda-by-Erwin-W-Lutzer.pdf
    • http://owlaokopdf.myhome.cx/281638169816581628162/Cross-Winds-Seventh-Cross-1-by-Brian-L-Stowe.pdf
    • http://owlaokopdf.myhome.cx/18167816581668166/Root-of-Evil-by-James-Cross.pdf
    • http://owlaokopdf.myhome.cx/381648169816681658165/The-Butter-Cross-by-Alison-James.pdf
    • http://owlaokopdf.myhome.cx/281618169816881668162/Taming-Cross-Love-Inc-2-by-Ella-James.pdf
    • http://owlaokopdf.myhome.cx/481618163816081698161/Taming-Cross-Love-Inc-2-by-Ella-James.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.