Malicious PDF — malware analysis report

Static analysis result for SHA-256 e5adbcf319230591…

MALICIOUS

PDF

34.3 KB Created: 2019-05-03 06:38:38 +01:00 Authoring application: mPDF 5.7
MD5: ff9a8bb6ab09d9bc793825534d254687 SHA-1: 0f1a233fef2500ad8c45ceb1036ce4857cd17ba5 SHA-256: e5adbcf319230591b99aebbc4f89243ec138b71f740cc30178080df954d00b15
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF documents. These links are hosted on a dynamic DNS domain, suggesting a link farm or redirection scheme. The primary heuristic firing indicates a 'PDF_SEO_LINK_FARM', suggesting the document's purpose is to drive traffic to these external resources. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1200205209206205201/Waldschutzgebiet-Liste-Der-Schutzgebiete-in-Baden-Wurttemberg-Urwald-Weisswasser-Bannwald-Nationalpark-Garajonay-Schutzwald-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/8208208203203206/Bahnstrecke-in-Baden-Wurttemberg-Strassenbahn-Ravensburg-Weingarten-Baienfurt-Neubaustrecke-Wendlingen-Ulm-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1201205209208207207/Wassermuhle-in-Baden-Wurttemberg-Muhlenstrasse-Oberschwaben-Funfmuhlental-Glemsmuhlen-Fessler-Muhle-Klingenmuhle-Einbacher-Muhle-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200204203206209208/Felsen-in-Deutschland-Felsen-Im-Saarland-Felsen-in-Baden-Wurttemberg-Felsen-in-Bayern-Felsen-in-Hessen-Felsen-in-Niedersachsen-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200205200209201204/Festung-in-Deutschland-Festung-in-Baden-Wurttemberg-Festung-in-Bayern-Festung-in-Berlin-Festung-in-Brandenburg-Festung-in-Hessen-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200207201203206203/Judischer-Friedhof-in-Deutschland-Judischer-Friedhof-Im-Saarland-Judischer-Friedhof-in-Baden-Wurttemberg-Judischer-Friedhof-in-Bayern-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1201206206201202204/Denkmalwesen-Denkmal-Denkmalpflege-Kleindenkmal-Kulturdenkmal-Liste-Denkmal-Patina-Knesset-Liste-Der-Kulturdenkmaler-in-Bremerhaven-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200205205205208209/Bischof-Von-Passau-Liste-Der-Bischofe-Von-Passau-Liste-Der-Weihbischofe-in-Passau-Ernst-Von-Bayern-Wladislaw-Von-Schlesien-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1201206203200204208/Politik-Mexiko-Deutscher-Botschafter-in-Mexiko-Liste-Diplomatisches-Corps-in-Mexiko-Liste-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200203200201207206/Platz-in-Wien-Heldenplatz-Liste-Der-Strassennamen-Von-Wien-Donaustadt-Liste-Der-Strassennamen-Von-Wien-Floridsdorf-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/9201200208202203/Museum-in-Potsdam-Sanssouci-Stadtschloss-Villa-Schoningen-Liste-Der-Museen-in-Berlin-Und-Der-Naheren-Umgebung-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1201200202202204203/Schweizer-Habsburgerkriege-Mordnacht-Von-Zurich-Liste-Der-Gefallenen-Adeligen-Auf-Habsburger-Seite-in-Der-Schlacht-Bei-Sempach-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200204200204209201/Die-Kelten-in-Baden-W-rttemberg-by-Kurt-Bittel.pdf
    • http://xiixmcuin.linkpc.net/8208202201202200/Die-Afd-VOR-Der-Landtagswahl-in-Baden-Wurttemberg-by-Julia-Sohne.pdf
    • http://xiixmcuin.linkpc.net/7205207200201209/Okkultismus-Hermetic-Order-of-the-Golden-Dawn-Magie-Ordo-Templi-Orientis-Schadenszauber-Tarot-Theosophie-Liste-Magischer-Schriften-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/9205203200201205/Crashkurs-Ein-Baden-W-rttemberg-Krimi-by-Birgit-Hummler.pdf
    • http://xiixmcuin.linkpc.net/1200205202205207204/Kathedrale-Sophienkirche-St-Patrick-s-Cathedral-Speyerer-Dom-Kathedrale-St-Stanislaus-Grabeskirche-Liste-Von-Kathedralen-in-Afrika-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200208200209209204/Denkmal-in-Munchen-Liste-Munchner-Denkmaler-Bavaria-Munchner-Gedenkstatten-Fur-Opfer-Des-Nationalsozialismus-Feldherrnhalle-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1201201209208203200/Museum-in-Hamburg-Hamburger-Kunsthalle-Miniatur-Wunderland-Liste-Der-Museen-in-Hamburg-Freilichtmuseum-Am-Kiekeberg-Ballinstadt-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/6206208200205207/Ehemalige-Gemeinde-in-Finnland-Liste-Der-Ehemaligen-Gemeinden-in-Finnland-Inio-Ekenas-Kulosaari-Ylamaa-Karis-Ruotsinpyhtaa-by-Quelle-Wikipedia.pdf
    • http://xiixmcuin.linkpc.net/1200204203206209208/Felsen-in-Deutschland-Felsen-Im-Saarland-Felsen-in-Baden-Wurttemberg-Felsen-in-Bayern-Felsen-in-Hessen-Felsen-in-Nieders

Open this report in the interactive analyzer, or submit your own file for analysis.