Malicious PDF — malware analysis report

Static analysis result for SHA-256 c94a58cd31386115…

MALICIOUS

PDF

17.2 KB Created: 2019-05-03 16:12:33 +01:00 Authoring application: mPDF 5.7
MD5: 81fa2a7f302eb9408f2e21c7bc288869 SHA-1: 629e1e29371b4f0bd667d2923c717d12b1b817b1 SHA-256: c94a58cd31386115e6e94d1ec6f7aabb156197dc7fd99cc6b3076eb4c656995c
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified as a link farm. The primary heuristic indicates a critical finding related to this link farm, suggesting a malicious intent to redirect users. While the URLs themselves are currently labeled as benign, the sheer volume and the heuristic's classification point towards a potential SEO manipulation or a distribution point for further malicious activity. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9730731738738/Quantum-and-Woody-by-Priest-amp-Bright-Volume-3-And-So-by-Christopher-J-Priest.pdf
    • http://cefasfese.4pu.com/5734734735739730/L-Adjacent-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/3736737731731732/The-Separation-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/1730737732730732/The-Separation-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/1733737732731739/The-Prestige-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/9735730738737730/The-Gradual-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/1730733738733735/The-Adjacent-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/4735733730737739/Inverted-World-by-Christopher-Priest.pdf
    • http://cefasfese.4pu.com/8731735732731731/Titans-The-Lazarus-Contract-by-Christopher-J-Priest.pdf
    • http://cefasfese.4pu.com/1731732739739739738/KLANG-A-Writer-s-Commentary-by-Christopher-J-Priest.pdf
    • http://cefasfese.4pu.com/1730731732737737731/Green-Lantern-Sleepers-Book-3-by-Christopher-J-Priest.pdf
    • http://cefasfese.4pu.com/4730736732737739/The-Priest-and-the-Medium-The-Amazing-True-Story-of-Psychic-Medium-B-Anne-Gehman-and-Her-Husband-Former-Jesuit-Priest-Wayne-Knoll-Ph-D-by-Suzanne-R-Giesemann.pdf
    • http://cefasfese.4pu.com/7736732737735732/Naissance-Et-Affirmation-de-La-Reforme-by-Jean-Delumeau.pdf
    • http://cefasfese.4pu.com/1737734736738732/Affirmation-Legal-Affairs-1-6-by-Sawyer-Bennett.pdf
    • http://cefasfese.4pu.com/2737733730739737/Affirmation-Daybook-Journal-by-Cherrye-S-Vasquez.pdf
    • http://cefasfese.4pu.com/3732731730738738/Affirmation-Poetry-for-Expectant-Mothers-by-Elizabeth-D-Gray.pdf
    • http://cefasfese.4pu.com/3732730733731739/7-Day-Confidence-and-Ego-Boost-Affirmation-Plan-by-Stephen-Richards.pdf
    • http://cefasfese.4pu.com/3732731737736738/Affirmation-Poetry-For-Wealth-and-Abundance-by-Elizabeth-D-Gray.pdf
    • http://cefasfese.4pu.com/1735733738736/The-Heretical-Imperative-Contemporary-Possibilities-of-Religious-Affirmation-by-Peter-L-Berger.pdf
    • http://cefasfese.4pu.com/5739738733735732/Somewhere-in-Heaven-The-Remarkable-Love-Story-of-Dana-and-Christopher-Reeve-by-Christopher-Andersen.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.