Malicious PDF — malware analysis report

Static analysis result for SHA-256 db7bc73a3586b297…

MALICIOUS

PDF

17.1 KB Created: 2019-04-30 09:41:40 +01:00 Authoring application: mPDF 5.7
MD5: 7ddc8d943aecfd4c647e662010343f48 SHA-1: 76d1e2d92e94df70a633df19c7b94a39c4c3d1db SHA-256: db7bc73a3586b29731b154b4d0fd3ab2a2ae749f4ca88881df5a0ecba9b3c26f
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF document contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or redirection scheme. The heuristic 'PDF_SEO_LINK_FARM' indicates this behavior, with the dominant host being 'cefasfese.4pu.com'. No scripts were extracted from this sample. The primary attack pattern involves directing users to a multitude of external resources, likely for SEO manipulation or to host malicious content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730738736731737/Rival-Love-Rival-Love-1-by-Natalie-Decker.pdf
    • http://cefasfese.4pu.com/1730739736737734738/The-Rival-by-Sandra-Gustafsson.pdf
    • http://cefasfese.4pu.com/3738739736737736/Mr-Darcy-s-Rival-by-Kara-Louise.pdf
    • http://cefasfese.4pu.com/4731734735737736/Unequaled-No-Rival-3-by-Charity-Parkerson.pdf
    • http://cefasfese.4pu.com/3739732735736734/Reaper-s-Rival-by-Simone-Elise.pdf
    • http://cefasfese.4pu.com/2737732736739734/One-Rogue-Too-Many-Rival-Rogues-1-by-Samantha-Grace.pdf
    • http://cefasfese.4pu.com/1739733732732736/Marvino-s-League-of-Superheroes-by-Rae-Rival-Cosico.pdf
    • http://cefasfese.4pu.com/1739737738733735/Her-Favorite-Rival-Mathews-Sisters-2-by-Sarah-Mayberry.pdf
    • http://cefasfese.4pu.com/5737733730737736/One-Night-with-Gael-Rival-Brothers-2-by-Maya-Blake.pdf
    • http://cefasfese.4pu.com/3737732734732734/Death-s-Rival-Jane-Yellowrock-5-by-Faith-Hunter.pdf
    • http://cefasfese.4pu.com/4731733737737732/Fushigi-Y-gi-The-Mysterious-Play-Vol-5-Rival-by-Yuu-Watase.pdf
    • http://cefasfese.4pu.com/2730731732736736/Rival-Ambassadors-at-the-Court-of-Queen-Mary-by-E-Harris-Harbison.pdf
    • http://cefasfese.4pu.com/3739736736737731/Rival-Magic-Dragon-Born-Serafina-4-by-Ella-Summers.pdf
    • http://cefasfese.4pu.com/4735731738730/The-Dark-Rival-Star-Wars-Jedi-Apprentice-2-by-Jude-Watson.pdf
    • http://cefasfese.4pu.com/6735736739737738/Tocqueville-in-the-Ottoman-Empire-Rival-Paths-to-the-Modern-State-by-Ariel-Salzmann.pdf
    • http://cefasfese.4pu.com/1731734737733733735/Rival-Queens-Actresses-Performance-and-the-Eighteenth-Century-British-Theater-by-Felicity-Nussbaum.pdf
    • http://cefasfese.4pu.com/7732737731737/Rival-Rails-The-Race-to-Build-America-s-Greatest-Transcontinental-Railroad-by-Walter-R-Borneman.pdf
    • http://cefasfese.4pu.com/5730737732730735/Leaving-Earth-Space-Stations-Rival-Superpowers-and-the-Quest-for-Interpanetary-Travel-by-Robert-Zimmerman.pdf
    • http://cefasfese.4pu.com/3735739731732737/On-the-Run-by-Bethany-Shaw.pdf
    • http://cefasfese.4pu.com/1730738732733739/Little-Birdie-by-Bethany-Thompson.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.