Malicious PDF — malware analysis report

Static analysis result for SHA-256 d20fdcf20ab077f0…

MALICIOUS

PDF

25.4 KB Created: 2019-04-30 10:11:57 +01:00 Authoring application: mPDF 5.7
MD5: 77014d6854ce03d5235dec501d503169 SHA-1: 88c5adb010be28f24b540efedbf6c80749c0edc0 SHA-256: d20fdcf20ab077f020f5b527e363835cc504cb55f89e87d651945adf55da05ae
68 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains an embedded JavaScript stream and a large number of external links, as indicated by the PDF_JS and PDF_SEO_LINK_FARM heuristics. The embedded links point to various Baedeker travel guides, but the sheer volume and the nature of the PDF_SEO_LINK_FARM heuristic suggest a malicious intent, possibly for SEO poisoning or to host malicious content. The embedded JavaScript is likely responsible for executing the malicious payload or redirecting the user. The dominant host for these links is cefasfese.4pu.com.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9737730737738736/Baedeker-s-France-by-Jarrold-Baedeker.pdf
    • http://cefasfese.4pu.com/4738738736735734/Southern-France-Including-Corsica-Handbook-for-Travellers-by-Karl-Baedeker-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/4738738736733730/Great-Britain-Volume-1-Southern-England-amp-East-Anglia-Handbook-for-Travellers-by-Karl-Baedeker-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/4738738736734739/The-Rhine-from-Rotterdam-to-Constance-Handbook-for-Travellers-by-Karl-Baedeker-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/4738738737737735/Norway-and-Sweden-Handbook-For-Travellers-by-Karl-Baedeker-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/4738738738731732/Northern-France-From-Belgium-and-the-English-Channel-to-the-Loire-Excluding-Paris-and-Its-Environs-Handbook-for-Travellers-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/9737730737738738/Baedeker-s-Florida-by-John-E-Kwoka-Jr-.pdf
    • http://cefasfese.4pu.com/9737730738736733/Baedeker-s-New-Zealand-by-John-Molluzzo.pdf
    • http://cefasfese.4pu.com/9732730734731734/Baedeker-Greece-by-Bernhard-Abend.pdf
    • http://cefasfese.4pu.com/9737730737737738/Europe-without-Baedeker-by-Edmund-Wilson.pdf
    • http://cefasfese.4pu.com/9737730737738730/Baedeker-Germany-by-Alec-Court.pdf
    • http://cefasfese.4pu.com/9737730738737736/Iceland-Baedeker-Guide-by-Christian-Nowak.pdf
    • http://cefasfese.4pu.com/6736731730736739/Baedekers-Great-Britain-1890-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/6738730730731738/Paris-and-Environs-with-Routes-from-London-to-Paris-Handbook-for-Travellers-by-Karl-Baedeker.pdf
    • http://cefasfese.4pu.com/6739734738732733/Airlines-of-France-Air-France-Openskies-Aigle-Azur-XL-Airways-France-Corsairfly-Regional-Compagnie-Aerienne-Europeenne-by-Source-Wikipedia.pdf
    • http://cefasfese.4pu.com/6737731731730737/Emission-Diffusee-Sur-France-2-Intervilles-Telethon-En-France-on-N-Demande-Qu-a-En-Rire-N-Oubliez-Pas-Les-Paroles-Faites-Entrer-L-Accuse-by-Source-Wikipedia.pdf
    • http://cefasfese.4pu.com/7734739738736739/Histoire-De-France-En-Bandes-Dessin-es-No-4---Hughes-Capet-Guillame-le-Conqu-rant-Histoire-De-France-4-by-V-ctor-Mora.pdf
    • http://cefasfese.4pu.com/5733736732736736/Novels-of-Anatole-France-Penguin-Island-Crime-of-Sylvestre-Bonnard-Revolt-of-the-Angels-by-Anatole-France.pdf
    • http://cefasfese.4pu.com/7730737735737735/Histoire-De-France-En-Bandes-Dessin-es-No-14---Le-Regne-de-Louis-XV-L-ind-pendance-am-ricaine-Histoire-De-France-14-by-Jean-Ollivier.pdf
    • http://cefasfese.4pu.com/7730737735737732/Histoire-De-France-En-Bandes-Dessin-es-No-20---La-Commune-La-Troisieme-R-publique-Histoire-De-France-20-by-Jean-Ollivier.pdf
    • http://cefasfese.4pu.com/4738738

Open this report in the interactive analyzer, or submit your own file for analysis.