Malicious PDF — malware analysis report

Static analysis result for SHA-256 ea23916a547a1ada…

MALICIOUS

PDF

16.6 KB Created: 2019-06-10 04:48:34 +01:00 Authoring application: mPDF 5.7
MD5: 3dd90b9ad29452e21b342590db319876 SHA-1: b9d3794ef31db0948839e4a0695ced435952aaf7 SHA-256: ea23916a547a1adab98bb9fbefe7af324abb6660dddd557da0d83217313d8309
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. These URLs are hosted on the domain 'cefasfese.4pu.com', which is associated with a link farm. The document body, though partially corrupted, also contains these URLs. The primary attack pattern appears to be SEO poisoning or a similar technique to drive traffic to potentially malicious or unwanted content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4734736736739738/Justice-for-Corrie-Badge-of-Honor-Texas-Heroes-3-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/3731738735739735/Shelter-for-Elizabeth-Badge-of-Honor-Texas-Heroes-5-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/3731739737732737/Shelter-for-Adeline-Badge-of-Honor-Texas-Heroes-7-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/4734736736739736/Rescuing-Harley-Delta-Force-Heroes-3-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/1731734739739737731/Rescuing-Sadie-Delta-Force-Heroes-7-5-Masters-amp-Mercenaries-Crossover-Collection-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/7737739735730739/The-Vigilantes-Badge-of-Honor-10-by-W-E-B-Griffin.pdf
    • http://cefasfese.4pu.com/6734738737735733/Special-Operations-Badge-of-Honor-2-by-W-E-B-Griffin.pdf
    • http://cefasfese.4pu.com/2733730732731739/Texas-C-H-A-O-S-Texas-Heroes-2-by-Sable-Hunter.pdf
    • http://cefasfese.4pu.com/2731736732734733/Outback-Hearts-Beyond-Reality-1-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/2730739730737/True-Honor-Uncommon-Heroes-3-by-Dee-Henderson.pdf
    • http://cefasfese.4pu.com/8732731732732/Protecting-Melody-SEAL-of-Protection-7-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/4736736737739731/Marrying-Caroline-SEAL-of-Protection-3-5-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/4735731730734739/Protecting-Jessyka-SEAL-of-Protection-6-by-Susan-Stoker.pdf
    • http://cefasfese.4pu.com/4738737730735739/A-Question-of-Honor-The-Kosciuszko-Squadron-Forgotten-Heroes-of-World-War-II-by-Lynne-Olson.pdf
    • http://cefasfese.4pu.com/3732732738735/The-Hiding-Place-The-Triumphant-True-Story-of-Corrie-Ten-Boom-by-Corrie-ten-Boom.pdf
    • http://cefasfese.4pu.com/4737737739737734/Musicological-Identities-Essays-in-Honor-of-Susan-McClary-by-Susan-McClary.pdf
    • http://cefasfese.4pu.com/3731736730733735/Tracking-Justice-Texas-K-9-Unit-1-by-Shirlee-McCoy.pdf
    • http://cefasfese.4pu.com/4739736738735737/Heroes-Are-My-Weakness-by-Susan-Elizabeth-Phillips.pdf
    • http://cefasfese.4pu.com/6730734736738739/Gedenkschrift-in-Honor-of-William-R-Freudenburg-by-Susan-Maret.pdf
    • http://cefasfese.4pu.com/1732736736736/Heaven-in-West-Texas-by-Susan-Kay-Law.pdf
    • http://cefasfese.4pu.com/8732731732732/

Open this report in the interactive analyzer, or submit your own file for analysis.