Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8cfb4c15dbf45e9…

MALICIOUS

PDF

16.5 KB Created: 2020-03-15 22:22:38 +00:00 Authoring application: mPDF 5.7
MD5: 93e6dacdbe5570b7a2df11498bd7a15f SHA-1: f84a7d9b69f608fc5d647992d8dd5f7d3bbd9c03 SHA-256: e8cfb4c15dbf45e988633f9d47b4f354604f96e644f68d59e49a510715485a49
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents hosted on the domain 'owlaokopdf.myhome.cx'. This heuristic firing indicates a link farm designed to drive traffic or potentially distribute further malicious content. No scripts were extracted, and the document body was heavily corrupted, limiting further analysis.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/1816181648166816081638163/Pound-for-Pound-A-Story-of-One-Woman-s-Recovery-and-the-Shelter-Dogs-Who-Loved-Her-Back-to-Life-by-Shannon-Kopp.pdf
    • http://owlaokopdf.myhome.cx/581698162816481658162/Chic-amp-Slim-Toujours-Aging-Beautifully-Like-Those-Chic-French-Women-by-Anne-Barone.pdf
    • http://owlaokopdf.myhome.cx/181638169816881658162/Selected-Poems-of-Ezra-Pound-by-Ezra-Pound.pdf
    • http://owlaokopdf.myhome.cx/281698162816281668164/The-Fourth-Piece-Order-s-Last-Play-1-by-E-Ardell.pdf
    • http://owlaokopdf.myhome.cx/481648164816081638169/Lousy-Magnet-by-Sally-Max.pdf
    • http://owlaokopdf.myhome.cx/181618162816481688160/Geek-Magnet-by-Kieran-Scott.pdf
    • http://owlaokopdf.myhome.cx/881678168816481618164/The-Wiener-Dog-Magnet-by-Hayes-Roberts.pdf
    • http://owlaokopdf.myhome.cx/181668163816781628161/Trouble-Magnet-Pip-amp-Flinx-12-by-Alan-Dean-Foster.pdf
    • http://owlaokopdf.myhome.cx/881688169816881638166/High-Tc-Superconductors-for-Magnet-and-Energy-Technology-by-Beate-R-Lehndorff.pdf
    • http://owlaokopdf.myhome.cx/581668160816081698160/Interior-Permanent-Magnet-Synchronous-Motors-by-Arash-Kiyoumarsi.pdf
    • http://owlaokopdf.myhome.cx/1816081648162816981648164/Elektra-by-E-Pound.pdf
    • http://owlaokopdf.myhome.cx/681688163816681608169/Human-Magnet-Syndrome-Why-We-Love-People-Who-Hurt-Us-by-Ross-Rosenberg.pdf
    • http://owlaokopdf.myhome.cx/881688169816881638165/High-Tc-Superconductors-for-Magnet-and-Energy-Technology-Fundamental-Aspects-by-Beate-R-Lehndorff.pdf
    • http://owlaokopdf.myhome.cx/881648162816881658166/Ezra-Pound-by-Peter-Ackroyd.pdf
    • http://owlaokopdf.myhome.cx/1816081618169816681698169/Hugh-Selwyn-Mauberley-by-Ezra-Pound.pdf
    • http://owlaokopdf.myhome.cx/481688163816281628164/Person-The-Shorter-Poems-by-Ezra-Pound.pdf
    • http://owlaokopdf.myhome.cx/481648160816681608165/One-Pound-Gospel-Volume-1-by-Rumiko-Takahashi.pdf
    • http://owlaokopdf.myhome.cx/881608160816281658164/Confucius-to-Cummings-An-Anthology-of-Poetry-by-Ezra-Pound.pdf
    • http://owlaokopdf.myhome.cx/381638168816281658164/A-Pound-of-Flesh-Marja-Duology-2-by-Susan-Wright.pdf
    • http://owlaokopdf.myhome.cx/381618162816681638160/Selected-Poems-1908-1969-by-Ezra-Pound.pdf
    • http://owlaokopdf.myhome.cx/581668160816081698160/Interior-Permanent-Mag

Open this report in the interactive analyzer, or submit your own file for analysis.