Malicious PDF — malware analysis report

Static analysis result for SHA-256 d600e11ee17e7ff9…

MALICIOUS

PDF

16.1 KB Created: 2020-02-14 19:24:52 +00:00 Authoring application: mPDF 5.7
MD5: b1838eb9eaed7c240f444cb339dfb535 SHA-1: ce8b91df254ed760fceb9fadd4e73bd1389f2497 SHA-256: d600e11ee17e7ff9761ff05d54d9115234e4564606d6b9adcfcee20155b75433
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, all pointing to the same dominant host 'easckaolp.myhome.cx'. The SE_LOLBIN_RUN_COMMAND heuristic indicates that the document contains instructions for executing Windows scripting tools, suggesting an intent to download and execute further malicious content or redirect the user to a malicious site. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visible LOLBin command execution instruction high SE_LOLBIN_RUN_COMMAND
    Document contains instructions or visible command text involving Windows script/execution tools such as PowerShell, mshta, cmd, rundll32, or regsvr32
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://easckaolp.myhome.cx/6849847845846847/Duck-Duck-Dinosaur-by-Kallie-George.pdf
    • http://easckaolp.myhome.cx/6845843845844/Donald-Duck-Comics-Donald-Duck-Comics-by-Carl-Barks-Donald-Duck-Comics-by-Don-Rosa-the-Life-and-Times-of-Scrooge-McDuck-by-Source-Wikipedia.pdf
    • http://easckaolp.myhome.cx/3845842846849846/Duck-Duck-Ghost-Hellsinger-2-by-Rhys-Ford.pdf
    • http://easckaolp.myhome.cx/7846849845844848/Pekin-Ducks-as-Pets-American-Pekin-Duck-Owner-s-Manual-American-Pekin-Duck-Pros-and-Cons-Care-Housing-Diet-and-Health-All-Included-by-Roland-Ruthersdale.pdf
    • http://easckaolp.myhome.cx/5841841844848841/Duck-for-Cover-by-Paul-Jennings.pdf
    • http://easckaolp.myhome.cx/7844841847841/Howard-the-Duck-MAX-by-Steve-Gerber.pdf
    • http://easckaolp.myhome.cx/2847847848843/Duck-On-A-Bike-by-David-Shannon.pdf
    • http://easckaolp.myhome.cx/7844840841841846/Daddy-Sat-on-a-Duck-by-Scott-Cohn.pdf
    • http://easckaolp.myhome.cx/8842847848844848/Ruptured-Duck-by-Charles-Rodgers.pdf
    • http://easckaolp.myhome.cx/1849848849848846/A-Lot-of-Fuss-About-a-Duck-by-Elise-Lowe.pdf
    • http://easckaolp.myhome.cx/4848841845840849/Puddle-Duck-by-Louis-Ross.pdf
    • http://easckaolp.myhome.cx/3841849841842846/Little-White-Duck-A-Childhood-in-China-by-Na-Liu.pdf
    • http://easckaolp.myhome.cx/2844846841848846/Ennui-by-Phillip-Thomas-Duck.pdf
    • http://easckaolp.myhome.cx/1840842842844847/The-Wild-Duck-by-Henrik-Ibsen.pdf
    • http://easckaolp.myhome.cx/1847843840843846/The-Woodcutter-s-Duck-by-Krystyna-Turska.pdf
    • http://easckaolp.myhome.cx/1841847847842846849/Herbie-the-Runaway-Duck-by-W-G-van-de-Hulst.pdf
    • http://easckaolp.myhome.cx/9843841848845849/DUCK-IN-A-RAINCOAT-by-Maura-Curley.pdf
    • http://easckaolp.myhome.cx/9845845847849848/Duck-at-the-Door-by-Jackie-Urbanovic.pdf
    • http://easckaolp.myhome.cx/1841841845843842846/Duck-Dunks-by-Lynne-Berry.pdf
    • http://easckaolp.myhome.cx/7846849844848842/Barney-the-Pekin-Duck-by-Katherine-Bartlett.pdf
    • http://easckaolp.myhome.cx/2847847848843/Duck-On-A-Bike-by-Davi

Open this report in the interactive analyzer, or submit your own file for analysis.