Malicious PDF — malware analysis report

Static analysis result for SHA-256 cac17be81825d21b…

MALICIOUS

PDF

17.8 KB Created: 2019-06-04 10:03:13 +01:00 Authoring application: mPDF 5.7
MD5: 5c349d685060a94e668616de214d1acf SHA-1: 0f54e7ae0ee6b863de5d513274d8fad27f1db58e SHA-256: cac17be81825d21b9e6b4c42a57cc85f83e9a09516bb0c21a10533113649b847
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, all hosted on the domain 'cefasfese.4pu.com'. This technique is often used for SEO manipulation or to distribute a variety of malicious or unwanted content. No scripts were extracted from this sample, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731731731735735739/Mondstaub-Vampirroman-by-Arne-von-der-Wedemark.pdf
    • http://cefasfese.4pu.com/1730734732731737732/Blut-um-Mitternacht-Vampirroman-by-Petra-Teske.pdf
    • http://cefasfese.4pu.com/1731731731735735738/Blutn-chte-Erotischer-Vampirroman-by-Emilia-Jones.pdf
    • http://cefasfese.4pu.com/1731731731737732735/XXL-Leseprobe-Blut-um-Mitternacht-Vampirroman-by-Petra-Teske.pdf
    • http://cefasfese.4pu.com/1731731731736731735/Bloodbound-Lovers---Seelensplitter-Ein-Vampirroman-by-Sabine-Becker.pdf
    • http://cefasfese.4pu.com/1731731731737731738/Sternenaufgang-Vampirroman-Blut-um-Mitternacht-3-by-Petra-Teske.pdf
    • http://cefasfese.4pu.com/1731731731736731739/Der-Vampir-Leroy-de-Montegarde-Vampirroman-by-Petra-Teske.pdf
    • http://cefasfese.4pu.com/1730738733739736733/Vampirromane-sind-zum-Kotzen---ein-Vampirroman-by-Isabell-Schmitt-Egner.pdf
    • http://cefasfese.4pu.com/1731731731737732732/Liebe-gegen-Hass-Vampirroman-Mitternacht-Vampire-9-by-Petra-Teske.pdf
    • http://cefasfese.4pu.com/9733730739739733/Arne-by-Bj-rnstjerne-Bj-rnson.pdf
    • http://cefasfese.4pu.com/1734737737738731/The-Ballad-of-a-Broken-Nose-by-Arne-Svingen.pdf
    • http://cefasfese.4pu.com/1730733738730739733/Winter-Simulation-Conference-Proceedings-by-Arne-Thesen.pdf
    • http://cefasfese.4pu.com/1731733736733730737/Grosse-Seeschlachten-Wendepunkte-der-Weltgeschichte-by-Arne-Karsten.pdf
    • http://cefasfese.4pu.com/1730733738730739739/Computer-Methods-in-Operations-Research-by-Arne-Thesen.pdf
    • http://cefasfese.4pu.com/1730739739734737732/Explaining-Decisions-in-the-European-Union-by-Arne-Niemann.pdf
    • http://cefasfese.4pu.com/9735733733738738/Die-Eignung-Von-Dialoginseln-Fur-Die-Umsetzung-Des-Wissensmanagements-in-Der-Praxis-by-Arne-Heiland.pdf
    • http://cefasfese.4pu.com/1731738732730734/Carmanah-Artistic-Visions-of-an-Ancient-Rainforest-by-Arne-B-Hansen.pdf
    • http://cefasfese.4pu.com/1731738739738736735/Die-Bedeutung-Der-Prozesskostenrechnung-in-Logistischen-Dienstleistungsunternehmen-by-Arne-Friedl-Nder.pdf
    • http://cefasfese.4pu.com/9739730732739736/States-of-Exception-in-the-Contemporary-Novel-Martel-Eugenides-Coetzee-Sebald-by-Arne-De-Boever.pdf
    • http://cefasfese.4pu.com/4737730735736734/Baby-s-in-black-The-story-of-Astrid-Kirchherr-amp-Stuart-Sutcliffe-by-Arne-Bellstorf.pdf
    • http://cefasfese.4pu.com/1730733738730739733/Winter-Si

Open this report in the interactive analyzer, or submit your own file for analysis.