Malicious PDF — malware analysis report

Static analysis result for SHA-256 ccb8cff5a3df2310…

MALICIOUS

PDF

17.6 KB Created: 2019-04-30 05:08:53 +01:00 Authoring application: mPDF 5.7
MD5: 942efc48ba8d31e1f0247dcd821837e2 SHA-1: 7d79fa5bf9c71ffcb3a01d0e039365622e036b18 SHA-256: ccb8cff5a3df231073c6fead7c718476f8605b5e87f98778065a1f16c4087e11
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which point to external PDF documents. These URLs are presented in a way that suggests a link farm, likely intended to deceive users into clicking them. The document body confirms the presence of these URLs, which are disguised as book downloads.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/7207206206200203/The-Time-Machine-Science-Fiction-Classic-A-Time-Travel-Novel-from-the-English-futurist-historian-socialist-author-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/1201205202200201208/The-time-machine-Die-Zeitmaschine-Sentence-aligned-bilingual-english-german-edition-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/9205208208201207/The-Time-Traveller-s-Almanac-Part-IV---Communiqu-s-A-Treasury-of-Time-Travel-Fiction-Brought-to-You-from-the-Future-Time-Traveller-s-Almanac-Book-4-by-Ann-VanderMeer.pdf
    • http://xiixmcuin.linkpc.net/5204201200202204/The-Time-Machine-By-H-G-Wells---Illustrated-Comes-with-a-Free-Audiobook-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/3204205203200207/Star-Wars-on-Trial-The-Force-Awakens-Edition-Science-Fiction-and-Fantasy-Writers-Debate-the-Most-Popular-Science-Fiction-Films-of-All-Time-by-David-Brin.pdf
    • http://xiixmcuin.linkpc.net/6201207206208204/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/5206208200204201/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/6208205204203201/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/5206201208207201/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/7202205204202202/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/5200203207205207/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/6208203206203205/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/1200205207208206209/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/6206204201207204/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/6200203209200200/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/8207205208208203/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/8200209208205207/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/5209202206204207/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/2202202207200207/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/5203202205202209/The-Time-Machine-by-H-G-Wells.pdf
    • http://xiixmcuin.linkpc.net/3204205203200207/Star-Wars-on-Trial-The-Fo

Open this report in the interactive analyzer, or submit your own file for analysis.