Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4989413bdbe4baf…

MALICIOUS

PDF

19.7 KB Created: 2019-05-03 05:03:17 +01:00 Authoring application: mPDF 5.7
MD5: 49da6ef787aa93d6fe8183264c0b86d3 SHA-1: b5878ce4e027d3b0712aac7c7af60dc3e26e6f50 SHA-256: c4989413bdbe4baf3a9ed29c8d3c76d363cc5b71e36b5a62046fd8a0a3a39916
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, primarily hosted on the domain 'cefasfese.4pu.com'. This heuristic firing suggests a link farm or a method to distribute further malicious content. While the document body is heavily corrupted, the presence of numerous links to what appear to be book titles, combined with the 'PDF_SEO_LINK_FARM' heuristic, indicates a likely attempt to manipulate search engine results or distribute potentially harmful content disguised as legitimate documents. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4
    • http://cefasfese.4pu.com/1730738735733731736/Lost-Knowledge-of-the-Ancients-A-Graham-Hancock-Reader-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/9738731736736/The-Sign-and-the-Seal-The-Quest-for-the-Lost-Ark-of-the-Covenant-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/3732738737731736/War-God-Nights-of-the-Witch-War-God-1-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/1730738735735737736/War-God-Night-of-Sorrows-War-God-3-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/1730738735735736739/Dark-Discoveries---Issue-32-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/1736735736731730/Underworld-The-Mysterious-Origins-of-Civilization-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/5732739731736737/L-Empreinte-des-dieux-Une-nouvelle-interp-tation-des-grands-myst-res-de-ce-monde-by-Graham-Hancock.pdf
    • http://cefasfese.4pu.com/4730733730731735/In-the-Shadow-of-the-Mountains-The-Books-of-Lost-Knowledge-by-M-R-Graham.pdf
    • http://cefasfese.4pu.com/6739735739732738/Reminiscences-of-Winfield-Scott-Hancock-by-A-R-Hancock.pdf
    • http://cefasfese.4pu.com/1730738735733731735/Hancock-by-Freddie-Hancock.pdf
    • http://cefasfese.4pu.com/1731737739731733730/Briefe-Eines-Dollar-Koenigs-an-Seinen-Sohn-Diese-Briefe-Schrieb-Der-Chef-Der-Schweinefleisch-Versand-Grosshandlung-Graham-amp-Co-in-Chicago-Herr-John-Graham-an-Der-Boerse-Unter-Dem-Spitznamen-der-Alte-Schweine-Graham-Bekannt-and-Seinen-Sohn-Pierrepon-by-George-Horace-Lorimer.pdf
    • http://cefasfese.4pu.com/3737732730731733/After-Always-by-Barbara-J-Hancock.pdf
    • http://cefasfese.4pu.com/4730739732731730/The-Pulptress-by-Tommy-Hancock.pdf
    • http://cefasfese.4pu.com/5737735737739/The-Enclave-by-Karen-Hancock.pdf
    • http://cefasfese.4pu.com/4730735735737/Arena-by-Karen-Hancock.pdf
    • http://cefasfese.4pu.com/1732733734733738/Pog-the-Pixie-by-James-Hancock.pdf
    • http://cefasfese.4pu.com/1731730732737736/Raymond-and-Graham-Rule-the-School-Raymond-and-Graham-1-by-Mike-Knudson.pdf
    • http://cefasfese.4pu.com/1730738735736730739/The-Darkening-Hour-by-Penny-Hancock.pdf
    • http://cefasfese.4pu.com/1730738735735731739/Hancock-the-Superb-by-Glenn-Tucker.pdf
    • http://cefasfese.4pu.com/1730738735736731731/Love-in-the-Lakes-by-Penny-Hancock.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.