Malicious PDF — malware analysis report

Static analysis result for SHA-256 d71e9d089eca68f7…

MALICIOUS

PDF

17.3 KB Created: 2019-05-02 05:05:48 +01:00 Authoring application: mPDF 5.7
MD5: 6d2c7859f866a00c8b779be307f88d29 SHA-1: f430e4a21b131dcad3010d86fbb44ced5f5c0484 SHA-256: d71e9d089eca68f74f2c15fa6af492f18536c136aa21c77f253d359622916c4a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or as a distribution vector for further malicious content. No scripts were extracted, limiting the ability to determine a more specific attack pattern or family. The primary attack pattern observed is the use of a PDF to host a link farm.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2735733733737737/Dragon-s-Rise-Shadow-of-the-Dragon-3-by-Tielle-St-Clare.pdf
    • http://cefasfese.4pu.com/8737735732736731/G-A-Aiken-Bundle-The-Dragon-Who-Loved-Me-What-a-Dragon-Should-Know-amp-Last-Dragon-Standing-by-G-A-Aiken.pdf
    • http://cefasfese.4pu.com/7739735734730735/Christmas-Elf-by-Tielle-St-Clare.pdf
    • http://cefasfese.4pu.com/5738733739730734/Rise-of-the-Dragon-King-The-Dragoneers-Saga-5-by-M-R-Mathias.pdf
    • http://cefasfese.4pu.com/4734738734730738/Three-Part-Harmony-by-Tielle-St-Clare.pdf
    • http://cefasfese.4pu.com/4737732736732734/A-Change-of-Pace-by-Tielle-St-Clare.pdf
    • http://cefasfese.4pu.com/1730739738731730/Shadow-of-the-Dragon-by-Kyra-Dune.pdf
    • http://cefasfese.4pu.com/2734736731737734/Shadow-Dragon-by-Lance-Horton.pdf
    • http://cefasfese.4pu.com/3730735735737/Shadow-Dragon-by-Lance-Horton.pdf
    • http://cefasfese.4pu.com/4732737735737735/The-Billionaire-Dragon-Shifter-s-Mate-Gray-s-Hollow-Dragon-Shifters-1-by-Zoe-Chant.pdf
    • http://cefasfese.4pu.com/3732734736733739/Dragon-Guard-Series-Books-1-7-Dragon-Guards-1-7-by-Julia-Mills.pdf
    • http://cefasfese.4pu.com/1732730736730731/Dragon-Knight-s-Sword-Order-of-the-Dragon-Knights-1-by-Mary-Morgan.pdf
    • http://cefasfese.4pu.com/4735734733735733/The-Dragon-with-the-Girl-Tattoo-Paranormal-Dating-Agency-Dragon-Guard-16-by-Julia-Mills.pdf
    • http://cefasfese.4pu.com/8737735739732/How-to-Ride-a-Dragon-s-Storm-How-to-Train-Your-Dragon-7-by-Cressida-Cowell.pdf
    • http://cefasfese.4pu.com/1738739730732735/Dead-Sexy-Dragon-Dragon-Heat-1-by-Lolita-Lopez.pdf
    • http://cefasfese.4pu.com/1732734734734739/How-to-Twist-a-Dragon-s-Tale-How-to-Train-Your-Dragon-5-by-Cressida-Cowell.pdf
    • http://cefasfese.4pu.com/1730737737736730/The-Dragon-King-of-Beijing-Little-Tiger-and-the-Year-of-the-Dragon-1-by-D-B-Patterson.pdf
    • http://cefasfese.4pu.com/1735739736737734/The-Silent-Dragon-Children-of-The-Dragon-Nimbus-1-by-Irene-Radford.pdf
    • http://cefasfese.4pu.com/2735734732735730/The-Old-Dragon-of-the-Mountain-s-Christmas-Dragon-Lords-of-Valdier-9-by-S-E-Smith.pdf
    • http://cefasfese.4pu.com/4736730733735731/Dragon-Mates-Dragon-Knights-11-The-Sea-Captain-s-Daughter-3-by-Bianca-D-39-Arc.pdf
    • http://cefasfese.4pu.com/1732730736730731/Dragon-Knight-s-Sw

Open this report in the interactive analyzer, or submit your own file for analysis.