Malicious PDF — malware analysis report

Static analysis result for SHA-256 c039efacfbd65255…

MALICIOUS

PDF

17.5 KB Created: 2019-06-04 10:10:08 +01:00 Authoring application: mPDF 5.7
MD5: 8135bf022a6b4dbe32454a8ac38b2800 SHA-1: e90821ddf64dad73046172c325bb8a09edb47063 SHA-256: c039efacfbd65255eb81e0e64bd1d05ae6f85e862aa7ff77255385eb8f76bc1c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign content, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious payloads. The document body is heavily obfuscated, preventing a clear understanding of its direct user-facing purpose beyond hosting these links.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1735733733735739/Black-Sun-Phantom-Server-3-by-Andrei-Livadny.pdf
    • http://cefasfese.4pu.com/1735733733735734/The-Outlaw-Phantom-Server-2-by-Andrei-Livadny.pdf
    • http://cefasfese.4pu.com/3731734737737731/The-Important-Thing-About-Andrei-by-Andrei-Daniel-Proca.pdf
    • http://cefasfese.4pu.com/8733734739739736/Implementing-Tableau-Server-A-Guide-to-Implementing-Tableau-Server-by-Chandraish-Sinha.pdf
    • http://cefasfese.4pu.com/4733731734736733/Manifestations-of-a-Phantom-s-Soul-A-Phantom-of-the-Opera-Story-Collection-Volume-1-by-Michelle-Rodriguez.pdf
    • http://cefasfese.4pu.com/1731737739738736739/Kiss-of-the-Phantom-Phantom-3-by-Julie-Leto.pdf
    • http://cefasfese.4pu.com/6734734731737/Phantom-Bigfoot-amp-The-Vampettes-From-Venus-Phantom-Bigfoot-Series-2-by-Simon-Okill.pdf
    • http://cefasfese.4pu.com/3738735734736736/Phantom-Horse-Goes-to-Ireland-Phantom-Horse-3-by-Christine-Pullein-Thompson.pdf
    • http://cefasfese.4pu.com/1730736739735734739/Inside-Microsoft-SQL-Server-2005-T-SQL-Programming-by-Itzik-Ben-Gan.pdf
    • http://cefasfese.4pu.com/1731733732737732734/Building-a-Home-Server-With-Windows-8-1-by-Terry-Walsh.pdf
    • http://cefasfese.4pu.com/1730736739734739731/Inside-Microsoft-SQL-Server-2008-T-SQL-Querying-by-Itzik-Ben-Gan.pdf
    • http://cefasfese.4pu.com/4733731731731/Petersburg-by-Andrei-Bely.pdf
    • http://cefasfese.4pu.com/6739731734731730/Messiah-by-Andrei-Codrescu.pdf
    • http://cefasfese.4pu.com/1733737730731739/The-Foundation-Pit-by-Andrei-Platonov.pdf
    • http://cefasfese.4pu.com/1730737738738738739/Non-Official-Art-by-Andrei-Erofeev.pdf
    • http://cefasfese.4pu.com/3735739730737736/Petersburg-by-Andrei-Bely.pdf
    • http://cefasfese.4pu.com/4733735730735/The-Foundation-Pit-by-Andrei-Platonov.pdf
    • http://cefasfese.4pu.com/4737738738739731/Memoirs-by-Andrei-D-Sakharov.pdf
    • http://cefasfese.4pu.com/8734738733739733/Using-Samba-A-File-and-Print-Server-for-Heterogeneous-Networks-by-Peter-Kelly.pdf
    • http://cefasfese.4pu.com/1730735731737733730/Developing-Enterprise-Applications-With-Bea-Web-Logic-Server-by-Kaminaris-Stephanie-Fesler.pdf
    • http://cefasfese.4pu.com/6734734731737/Phantom-Bigfoot-amp-The-Vampe

Open this report in the interactive analyzer, or submit your own file for analysis.