Malicious PDF — malware analysis report

Static analysis result for SHA-256 f63da2c9780d600a…

MALICIOUS

PDF

17.2 KB Created: 2019-06-13 16:18:31 +01:00 Authoring application: mPDF 5.7
MD5: 3bee505346b9844a9d77c933e9cc92a3 SHA-1: a4a96618b18a4533f32a19148adccc3f448b9fea SHA-256: f63da2c9780d600a96b863b123ed76882c23ae8a8354e2a314691155e23b30aa
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, which suggests a link farm or traffic generation scheme. While many of these URLs are marked as confirmed benign, the sheer volume and the nature of the heuristic indicate a malicious intent to distribute content or potentially malware. No scripts were extracted from this sample, and the document body was not readable.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese
    • http://cefasfese.4pu.com/8730736736734738/Dakota-Dreamin-South-Dakota-Americana-41-by-Janet-Dailey.pdf
    • http://cefasfese.4pu.com/2739732735738738/His-Dakota-Heart-Dakota-Hearts-7-by-Lisa-Mondello.pdf
    • http://cefasfese.4pu.com/2730730733730732/Dakota-Home-Dakota-2-by-Debbie-Macomber.pdf
    • http://cefasfese.4pu.com/1731735730739736739/Mni-Wakan-Oyate-Spirit-Lake-Nation-A-History-of-the-Sisituwan-Wahpeton-Pabaksa-and-Other-Dakota-That-Settled-at-Spirit-Lake-North-Dakota-by-Mark-Diedrich.pdf
    • http://cefasfese.4pu.com/1734731735737730/Uncle-Andy-s-A-Faabbbulous-Visit-With-Andy-Warhol-by-James-Warhola.pdf
    • http://cefasfese.4pu.com/3731734735732732/Once-Humans-by-Massimo-Marino.pdf
    • http://cefasfese.4pu.com/2736735733731733/Mother-s-Love-by-Massimo-Marino.pdf
    • http://cefasfese.4pu.com/2736735733730733/A-Love-To-Live-For-by-Massimo-Marino.pdf
    • http://cefasfese.4pu.com/5735736730738736/Marino-Marini-by-Pierre-Case.pdf
    • http://cefasfese.4pu.com/2732737739734/Tomorrow-May-Be-Too-Late-by-Thomas-Marino.pdf
    • http://cefasfese.4pu.com/9737730735739736/Blueprints-Pediatrics-by-Bradley-S-Marino.pdf
    • http://cefasfese.4pu.com/2736735733732737/Till-Death-Do-Us-Part-by-Massimo-Marino.pdf
    • http://cefasfese.4pu.com/3738739733731733/Andy-McBean-and-the-War-of-the-Worlds-The-Amazing-Adventures-of-Andy-McBean-1-by-Dale-Kutzera.pdf
    • http://cefasfese.4pu.com/6739731730738734/Le-Cat-chisme-du-concile-de-Trente-by-Leonardo-Marino-de-Lanciano.pdf
    • http://cefasfese.4pu.com/7735730734733738/Marino-Faliero-Azione-Tragica-in-Tre-Atti-by-Emmanuele-Bidera.pdf
    • http://cefasfese.4pu.com/3739733732736739/-uncensored-inside-the-animal-liberation-movement-by-Camille-Marino.pdf
    • http://cefasfese.4pu.com/4735731732/Superficial-More-Adventures-from-The-Andy-Cohen-Diaries-by-Andy-Cohen.pdf
    • http://cefasfese.4pu.com/1730735738736734734/Il-Museo-Renato-Marino-Mazzacurati-Opere-Dalla-Donazione-Carla-Marzi-by-Martina-De-Luca.pdf
    • http://cefasfese.4pu.com/4732730734730736/Raven-by-Dakota-Rebel.pdf
    • http://cefasfese.4pu.com/4739736730737734/Not-All-Who-Wander-by-Dakota-Rebel.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.