Malicious PDF — malware analysis report

Static analysis result for SHA-256 cdc359f4440533e5…

MALICIOUS

PDF

15.2 KB Created: 2019-11-07 09:24:48 +00:00 Authoring application: mPDF 5.7
MD5: 5061ca66141ee11fcd5dd0cfbb860a90 SHA-1: 375ada65f67097d9233127416403077dbe846305 SHA-256: cdc359f4440533e5f8bcfa2501e7622c03cf2b7f49de86fd5cac82d6856b09cc
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various PDF files hosted on the 'cefasfese.4pu.com' domain. While the URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent, likely for SEO spam or to distribute further malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2739738735733733/Calix-Areion-Fury-MC-6-by-Esther-E-Schmidt.pdf
    • http://cefasfese.4pu.com/2739738736731735/Sico-Areion-Fury-MC-5-by-Esther-E-Schmidt.pdf
    • http://cefasfese.4pu.com/3733737739738730/Frederick-by-Esther-E-Schmidt.pdf
    • http://cefasfese.4pu.com/3733737739738733/Ford-The-Dudnik-Circle-1-by-Esther-E-Schmidt.pdf
    • http://cefasfese.4pu.com/2739738735732735/Unforgiving-Broken-Deeds-MC-4-by-Esther-E-Schmidt.pdf
    • http://cefasfese.4pu.com/1730738735735736731/Calix-Stay-Circle-of-Light-3-by-Niel-Hancock.pdf
    • http://cefasfese.4pu.com/6737736738737731/Fury-Rising-Fury-Unbound-1-by-Yasmine-Galenorn.pdf
    • http://cefasfese.4pu.com/6737736739736734/Fury-s-Mantle-Fury-Unbound-5-by-Yasmine-Galenorn.pdf
    • http://cefasfese.4pu.com/3733737730733731/Fury-The-Fury-Trilogy-1-by-Elizabeth-Miles.pdf
    • http://cefasfese.4pu.com/1735737733735737/Areion-Lunar-Medallion-Series-1-by-Lela-Grayce.pdf
    • http://cefasfese.4pu.com/9734731736738733/the-state-of-affairs-rethinking-infidelity-and-mating-in-captivity-2-books-collection-set-by-esther-perel---a-book-for-anyone-who-has-ever-loved-by-Esther-Perel.pdf
    • http://cefasfese.4pu.com/9735738730/This-Star-Won-t-Go-Out-The-Life-and-Words-of-Esther-Grace-Earl-by-Esther-Earl.pdf
    • http://cefasfese.4pu.com/3734738738734736/This-Star-Won-t-Go-Out-The-Life-and-Words-of-Esther-Grace-Earl-by-Esther-Earl.pdf
    • http://cefasfese.4pu.com/9730734736733732/Thistles-Poems-of-Esther-Raab-by-Esther-Raab.pdf
    • http://cefasfese.4pu.com/1731735738738737/Cold-Fury-Cold-Fury-1-by-T-M-Goeglein.pdf
    • http://cefasfese.4pu.com/9736730730732736/Okay-for-Now-by-Gary-D-Schmidt.pdf
    • http://cefasfese.4pu.com/3733736738738731/Fury-by-Cat-Porter.pdf
    • http://cefasfese.4pu.com/3731736734732736/What-Came-from-the-Stars-by-Gary-D-Schmidt.pdf
    • http://cefasfese.4pu.com/7735738730734/Esther-the-Queen-by-H-B-Moore.pdf
    • http://cefasfese.4pu.com/2732733733733736/The-Manipulated-Man-by-Esther-Vilar.pdf
    • http://cefasfese.4pu.com/9734731736738733/the-state-of-affairs-rethinking-infidelity-and-mating-in-captivity-2-books-colle

Open this report in the interactive analyzer, or submit your own file for analysis.