Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf121336847234f1…

MALICIOUS

PDF

13.4 KB Created: 2019-05-01 05:59:20 +01:00 Authoring application: mPDF 5.7
MD5: 64c40c838726a3d26d09c9aca403b2f4 SHA-1: 30a2307234d58cf2f7c6da95f5c6b9b986285e99 SHA-256: bf121336847234f1370b068cadae916dbb1f82f215006c7c9c68d5e0dc9fd7ce
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles, suggesting a potential SEO spam or content distribution scheme. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic indicate a malicious intent to manipulate search engine results or distribute content through deceptive means. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/2209206209206205/The-Sea-Breeze-Collection-Breathe-Because-of-Low-While-It-Lasts-Just-for-Now-Sea-Breeze-1-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6208203205202/Sometimes-It-Lasts-Sea-Breeze-5-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/5208206206204/While-It-Lasts-Sea-Breeze-3-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4200208202203/Bad-for-You-Sea-Breeze-7-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/1204205205202207/Until-the-End-Sea-Breeze-9-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/5203200207201/Bad-for-You-Sea-Breeze-7-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4200204208201202/Just-for-Now-Sea-Breeze-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6207200201206/Just-for-Now-Sea-Breeze-4-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4209200206207206/Breathe-Sea-Breeze-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6203204207209/Misbehaving-Sea-Breeze-6-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4201201201205204/Breathe-Sea-Breeze-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4201209200204/Hold-on-Tight-Sea-Breeze-8-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6201200209202/Until-the-End-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/9203201203201208/Never-Too-Far-Too-Far-2-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/4209203201205208/You-Were-Mine-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/3202202201207201/Fallen-Too-Far-Too-Far-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6204201204209202/Take-a-chance-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/9203201203201206/Fallen-Too-Far-Too-Far-1-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6204201204200209/Dangerous-Perfection-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/3203204208205/Never-Too-Far-Rosemary-Beach-2-Too-Far-2-by-Abbi-Glines.pdf
    • http://xiixmcuin.linkpc.net/6201200209202/Until-the-End-by

Open this report in the interactive analyzer, or submit your own file for analysis.