Malicious PDF — malware analysis report

Static analysis result for SHA-256 c404d1902a4af089…

MALICIOUS

PDF

14.2 KB Created: 2019-05-02 05:50:02 +01:00 Authoring application: mPDF 5.7
MD5: 65714e506cf2dc81142a29a6171f459a SHA-1: 3cac862fcea4bf58fd74c452d64edcbb460cf005 SHA-256: c404d1902a4af0891a24df5022e5b84790fdf8cc09978d9f04a827bc02091072
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to book titles on the domain xiixmcuin.linkpc.net. This domain is associated with a PDF_SEO_LINK_FARM heuristic, indicating a potential SEO poisoning or traffic generation scheme. While the URLs themselves are marked as confirmed benign, the sheer volume and the nature of the heuristic suggest a malicious intent to drive traffic or manipulate search results. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/9203205208206/Chasing-Shadows-Rising-Shadows-2-by-Ashley-Townsend.pdf
    • http://xiixmcuin.linkpc.net/9206205205208/Defying-Shadows-Rising-Shadows-3-by-Ashley-Townsend.pdf
    • http://xiixmcuin.linkpc.net/1207207201209202/Cameo-and-the-Vampire-Trilogy-of-Shadows-3-by-Dawn-McCullough-White.pdf
    • http://xiixmcuin.linkpc.net/2204203207204202/Cameo-and-the-Highwayman-Trilogy-of-Shadows-2-by-Dawn-McCullough-White.pdf
    • http://xiixmcuin.linkpc.net/1206205202200201/Shadows-at-Dawn-A-Borderlands-Massacre-and-the-Violence-of-History-by-Karl-Jacoby.pdf
    • http://xiixmcuin.linkpc.net/4209203202209207/Shadows-Before-Dawn-Finding-the-Light-of-Self-Love-Through-Your-Darkest-Times-by-Teal-Swan.pdf
    • http://xiixmcuin.linkpc.net/1202208204206201/Blood-Shadows-Blood-Curse-4-by-Tessa-Dawn.pdf
    • http://xiixmcuin.linkpc.net/8204200202203204/The-Suspicion-Animorphs-24-by-K-A-Applegate.pdf
    • http://xiixmcuin.linkpc.net/2201208200202204/Suspicion-by-Kate-Brian.pdf
    • http://xiixmcuin.linkpc.net/7206201208203/Suspicion-by-Alexandra-Monir.pdf
    • http://xiixmcuin.linkpc.net/4200208202200209/Suspicion-by-Alexandra-Monir.pdf
    • http://xiixmcuin.linkpc.net/1204208209209202/Suspicion-At-Sea-by-Amie-Nichols.pdf
    • http://xiixmcuin.linkpc.net/3208205203208200/Above-Suspicion-by-Helen-MacInnes.pdf
    • http://xiixmcuin.linkpc.net/5202201201208200/Suspicion-by-Joseph-Finder.pdf
    • http://xiixmcuin.linkpc.net/5205203206206202/Tropisms-and-The-Age-of-Suspicion-by-Nathalie-Sarraute.pdf
    • http://xiixmcuin.linkpc.net/3206206205204209/Past-Suspicion-by-Therese-Heckenkamp.pdf
    • http://xiixmcuin.linkpc.net/7203200206208206/The-Age-of-Suspicion-Essays-on-the-Novel-by-Nathalie-Sarraute.pdf
    • http://xiixmcuin.linkpc.net/3207204207209200/Past-Suspicion-by-Therese-Heckenkamp.pdf
    • http://xiixmcuin.linkpc.net/3208207202208/Hiding-in-the-Shadows-Bishop-Special-Crimes-Unit-2-Shadows-2-by-Kay-Hooper.pdf
    • http://xiixmcuin.linkpc.net/9207208208202/The-Legend-of-Faro-A-Tale-of-Two-Shadows-Shadows-of-Man-Book-1-by-Christopher-Ojinaka.pdf
    • http://xiixmcuin.linkpc.net/7206201208203/Suspicion-by-Alexandra-

Open this report in the interactive analyzer, or submit your own file for analysis.