Malicious PDF — malware analysis report

Static analysis result for SHA-256 c29798a7e52c05b5…

MALICIOUS

PDF

16.1 KB Created: 2019-05-02 05:39:55 +01:00 Authoring application: mPDF 5.7
MD5: 8231b537f959f0dfeb958ca51fb525b4 SHA-1: 900f2ae1a95c5cac2bac520fa3aace0ed03f9a38 SHA-256: c29798a7e52c05b5183f98ee025f0bb71954731f578c7ce5926a0abaa6da84ee
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute malicious content. While the document body is unreadable, the PDF_SEO_LINK_FARM heuristic indicates a mass of external links, with the primary host being cefasfese.4pu.com. No scripts were extracted from this sample. The attack pattern is inferred from the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/3733735730735736/The-Son-of-Neptune-Heroes-of-Olympus-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4736731737734734/The-Son-of-Neptune-The-Heroes-of-Olympus-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/3737730738735737/The-Son-of-Neptune-The-Heroes-of-Olympus-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/3735731731736738/The-Son-of-Neptune-Heroes-of-Olympus-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/2736735733739738/The-Son-of-Neptune-Heroes-of-Olympus-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/6738730734737/The-Blood-Of-Olympus-Heroes-of-Olympus-5-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4735735738738/The-Blood-of-Olympus-The-Heroes-of-Olympus-5-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4736731737734737/The-Blood-of-Olympus-The-Heroes-of-Olympus-5-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/7733734732734734/Con-trai-th-n-Neptune-C-c-Anh-H-ng-tr-n-nh-Olympus-t-p-2-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/1730737739738/The-Lost-Hero-The-Heroes-of-Olympus-1-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/1730739737738733731/The-Demigod-Diaries-The-Heroes-of-Olympus-2-5-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4736731737734736/The-House-of-Hades-Heroes-of-Olympus-4-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4738736734730732/The-Lost-Hero-The-Heroes-of-Olympus-1-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/2739734735733738/Das-Blut-des-Olymp-The-Heroes-of-Olympus-5-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4737733739735739/The-Heroes-of-Olympus-Paperback-Boxed-Set-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/5730732730731739/The-Lost-Hero-Heroes-of-Olympus-1-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/3732731735736731/The-Son-of-Neptune-The-Graphic-Novel-The-Heroes-of-Olympus-The-Graphic-Novels-2-by-Robert-Venditti.pdf
    • http://cefasfese.4pu.com/3738734732733/Demigods-and-Monsters-Your-Favorite-Authors-on-Rick-Riordan-s-Percy-Jackson-and-the-Olympians-Series-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/2731738733739732/The-Sea-of-Monsters-by-Rick-Riordan.pdf
    • http://cefasfese.4pu.com/4736733735734739/The-Son-of-Magic-by-Rick-Riordan.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.