Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa42a852579034bd…

MALICIOUS

PDF

15.4 KB Created: 2019-06-13 16:12:46 +01:00 Authoring application: mPDF 5.7
MD5: 8371307b045b0150bc9442f9e3c03e1b SHA-1: 1d54690fb0f9b61912f2574972f9c3a5f96bbe34 SHA-256: fa42a852579034bd67adee25c3d0124e2468a24dd6bfa74b7f99d9ed76d2154e
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded URLs, identified as a link farm. While the document body is heavily corrupted, the presence of numerous links suggests an attempt to direct users to external resources. The heuristic 'PDF_SEO_LINK_FARM' indicates a high volume of links, likely for SEO manipulation or to host malicious content. No scripts were extracted from this sample.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2732739735737735/Dear-Cara-Letters-from-Otto-Frank-Anne-s-Father-Shares-His-Wisdom-by-Cara-Weiss-Wilson.pdf
    • http://cefasfese.4pu.com/7732733732739/The-Homeric-Hymns-by-Homer.pdf
    • http://cefasfese.4pu.com/1735738734731731/Homeric-Hymns-by-Homer.pdf
    • http://cefasfese.4pu.com/1730737733738738730/Hymns-to-the-Night-Spiritual-Songs-by-Novalis.pdf
    • http://cefasfese.4pu.com/5734737734733731/Odes-Hymns-and-Other-Poems-by-Pierre-de-Ronsard.pdf
    • http://cefasfese.4pu.com/1730739730732736738/Sail-Away-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/4739734739732730/A-Mighty-Fortress-Hymns-of-the-West-1-by-Faith-Blum.pdf
    • http://cefasfese.4pu.com/6732736731734/Pole-Dancing-to-Gospel-Hymns-by-Andrea-Gibson.pdf
    • http://cefasfese.4pu.com/3734734739732732/Laughing-to-Keep-from-Crying-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/1731732731730737/Exit-Point-by-Laura-Langston.pdf
    • http://cefasfese.4pu.com/3734734737733730/The-Panther-and-the-Lash-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/3734734737732739/Tambourines-to-Glory-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/4738735733737/Selected-Poems-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/1731734731730736/Remember-Grandma-by-Laura-Langston.pdf
    • http://cefasfese.4pu.com/8731732739731730/The-Hymns-of-Qumran-Translation-and-Commentary-by-Bonnie-Pedrotti-Kittel.pdf
    • http://cefasfese.4pu.com/1731731735735737/Simple-Takes-a-Wife-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/9737738737731/The-Ways-of-White-Folks-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/3735730730739737/The-Dream-Keeper-and-Other-Poems-by-Langston-Hughes.pdf
    • http://cefasfese.4pu.com/5737738734733/No-Dark-Valley-Derby-5-by-Jamie-Langston-Turner.pdf
    • http://cefasfese.4pu.com/7735735735730731/Classic-Hymns-We-Love-Your-Favorite-Composers-Share-a-Few-of-Their-Favorites-by-Pepper-Choplin.pdf
    • http://cefasfese.4pu.com/3734734737732739/Tambourines-to-Glory-by-Langsto

Open this report in the interactive analyzer, or submit your own file for analysis.