Malicious PDF — malware analysis report

Static analysis result for SHA-256 daa57fb957a943da…

MALICIOUS

PDF

17.0 KB Created: 2019-05-01 09:44:58 +01:00 Authoring application: mPDF 5.7
MD5: 51ad8bcb301bc83886862f528caf019c SHA-1: 7a31087b93960c60e5f80ee2b2908781dd11177f SHA-256: daa57fb957a943da60697cdf8bdebd18cccccdeba50be31279a39a89d31bbce4
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a lure to a large collection of potentially malicious or unwanted content. The document body was unreadable, but the heuristic firings strongly suggest a malicious intent to direct users to a high volume of external resources. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730734731739737738/The-Jungle-with-eBook-by-Upton-Sinclair.pdf
    • http://cefasfese.4pu.com/6730739737731734/The-Jungle-Includes-Updated-MLA-Style-Citations-for-Scholarly-Secondary-Sources-Peer-Reviewed-Journal-Articles-and-Critical-Essays-by-Upton-Sinclair.pdf
    • http://cefasfese.4pu.com/6733735736731733/The-Metropolis-by-Upton-Sinclair.pdf
    • http://cefasfese.4pu.com/7737737737736735/World-s-End-by-Upton-Sinclair.pdf
    • http://cefasfese.4pu.com/5731734737731734/The-Campaign-of-the-Century-Upton-Sinclair-s-Race-for-Governor-of-California-and-the-Birth-of-Media-Politics-by-Greg-Mitchell.pdf
    • http://cefasfese.4pu.com/5737737734730739/The-Jungle-Book-Extracts-Le-Livre-De-La-Jungle-Extraits-by-Rudyard-Kipling.pdf
    • http://cefasfese.4pu.com/9731738733739732/Blood-Jungle-Ballet-Jungle-Beat-4-by-John-Enright.pdf
    • http://cefasfese.4pu.com/1730733734733738733/Das-M-dchen-und-der-Deserteur-Luke-Sinclair-Western-Band-27-by-Luke-Sinclair.pdf
    • http://cefasfese.4pu.com/1737738738734730/Twisted-Fate-by-Claire-Upton.pdf
    • http://cefasfese.4pu.com/1730732734732734735/Bald-Knobbers-by-Lucile-Morris-Upton.pdf
    • http://cefasfese.4pu.com/2737733738733738/The-Virgin-of-Clan-Sinclair-Clan-Sinclair-3-by-Karen-Ranney.pdf
    • http://cefasfese.4pu.com/9733730732732/Organizing-You-Finding-Your-Spiritual-Clutter-and-Using-Organization-to-Clear-It-Out-by-Shannon-Upton.pdf
    • http://cefasfese.4pu.com/3733733732738736/Jungle-Law-by-S-L-Armstrong.pdf
    • http://cefasfese.4pu.com/7736737736737735/Say-Hello-to-the-Jungle-Animals-by-Ian-Whybrow.pdf
    • http://cefasfese.4pu.com/3737735733736732/The-Bridge-in-the-Jungle-by-B-Traven.pdf
    • http://cefasfese.4pu.com/9733734735737739/Jungle-Girls-by-Jim-Silke.pdf
    • http://cefasfese.4pu.com/3738736732730731/This-Is-The-Jungle-by-Kenneth-Anderson.pdf
    • http://cefasfese.4pu.com/4733739736737739/Red-Jungle-by-Kent-Harrington.pdf
    • http://cefasfese.4pu.com/3737737736730735/Jungle-Land-by-R-M-DuChene.pdf
    • http://cefasfese.4pu.com/7738738734730738/Naming-the-Jungle-by-Antoine-Volodine.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.