Malicious PDF — malware analysis report

Static analysis result for SHA-256 d62c33274eed04cf…

MALICIOUS

PDF

16.8 KB Created: 2020-03-15 00:51:36 +00:00 Authoring application: mPDF 5.7
MD5: 696ee2ad9db5b10fe5bf1cc1927a4785 SHA-1: d9341c06e3e83e4f506969f7d06c628737124738 SHA-256: d62c33274eed04cf9eac92d173bfbafb51fbbb51b45fee06bf375718cc1a9c0a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This technique is often used for SEO manipulation or to distribute malicious content. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 23 external links, predominantly using numeric slugs. No scripts were extracted from this sample. The attack pattern is inferred from the link farm and the embedded URLs.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/252485248524352415249/Wild-Heart-Wild-1-by-Lori-Brighton.pdf
    • http://lwoscmobook.myhome.cx/852435241524352465246/Fisted-by-Jack-Brighton.pdf
    • http://lwoscmobook.myhome.cx/252465242524352455246/In-the-dark-by-Jack-Brighton.pdf
    • http://lwoscmobook.myhome.cx/852435241524152495249/Counting-Chimneys-A-novel-of-love-heartbreak-and-romance-in-1960s-Brighton-Brighton-Girls-Trilogy-3-by-Sandy-Taylor.pdf
    • http://lwoscmobook.myhome.cx/452405246524252405245/The-Story-Of-Wild-Goose-Jack-The-Life-And-Work-Of-Jack-Miner-by-James-M-Linton.pdf
    • http://lwoscmobook.myhome.cx/252485244524852475246/The-Wild-Side-Trilogy-by-R-K-Lilley.pdf
    • http://lwoscmobook.myhome.cx/35241524052455240/Eating-on-the-Wild-Side-by-Jo-Robinson.pdf
    • http://lwoscmobook.myhome.cx/95240524952475244/On-the-Wild-Side-by-Kate-Jenkins.pdf
    • http://lwoscmobook.myhome.cx/252495245524452455246/What-a-Bear-Wants-Wild-Side-1-by-Nikki-Winter.pdf
    • http://lwoscmobook.myhome.cx/452465240524652465244/Dare-You-To-Wild-Side-0-5-by-Riley-Hart.pdf
    • http://lwoscmobook.myhome.cx/552475244524252455248/The-Call-of-the-Wild---Jack-London---Original-Book---ANNOTATED-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/452445249524552405249/Vanilla-on-Top-Walk-on-the-Wild-Side-1-Heather-and-Tony-1-by-C-J-Ellisson.pdf
    • http://lwoscmobook.myhome.cx/852415247524252445248/Call-of-the-Wild-by-Jack-London-Short-Adventure-Novel-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/35241524152495246/This-Side-of-Wild-Mutts-Mares-and-Laughing-Dinosaurs-by-Gary-Paulsen.pdf
    • http://lwoscmobook.myhome.cx/452435241524352455243/Queens-are-Wild-by-Jack-Chaucer.pdf
    • http://lwoscmobook.myhome.cx/752485242524952425248/The-Call-of-the-Wild-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/252445240524152485245/The-Call-of-the-Wild-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/552435242524552445246/The-Call-of-the-Wild-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/65249524552415242/The-Call-of-the-Wild-by-Jack-London.pdf
    • http://lwoscmobook.myhome.cx/352455242524852415241/The-Call-of-the-Wild-by-Jack-London.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.