Malicious PDF — malware analysis report

Static analysis result for SHA-256 fca2a2179b7d5020…

MALICIOUS

PDF

20.4 KB Created: 2019-05-24 13:47:41 +01:00 Authoring application: mPDF 5.7
MD5: 55503f068dbf2bdc14864190d7693470 SHA-1: 3a9b97bafb2e11e64d3dac8de9c143f2a461fac8 SHA-256: fca2a2179b7d50206b26e2a750e907b3dccad576347fb4535eb58aa2d58f820a
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of embedded links pointing to external PDF files hosted on the domain 'cefasfese.4pu.com'. This is indicative of a link farm or a distribution point for further malicious content. No scripts were extracted, and the document body was unreadable, limiting the analysis of the specific lure. The primary attack pattern observed is the distribution of links to potentially malicious content.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4736730734738739/Weaving-A-Tapestry-of-Dreams-by-Jess-Fulton.pdf
    • http://cefasfese.4pu.com/4730736739735736/Weaving-A-Tapestry-of-Dreams-by-Jess-Fulton.pdf
    • http://cefasfese.4pu.com/9734731739739738/Norwegian-English-Dictionary-A-Pronouncing-and-Translating-Dictionary-of-Modern-Norwegian-Bokm-l-and-Nynorsk-with-a-Historical-and-Grammatical-Introduction-by-Einar-Ingvald-Haugen.pdf
    • http://cefasfese.4pu.com/3734738730736/The-Fionavar-Tapestry-The-Fionavar-Tapestry-1-3-by-Guy-Gavriel-Kay.pdf
    • http://cefasfese.4pu.com/4734736739737736/The-Weaving-by-Gerald-Costlow.pdf
    • http://cefasfese.4pu.com/1731733739731734735/Herkunft-Anwendung-und-Funktion-von-Anglizismen-in-der-deutschen-Sprache-by-Christin-K-ppen.pdf
    • http://cefasfese.4pu.com/1731733739730734734/Energy-Balance-Equivalents-To-The-K-ppen-Geiger-Climatic-Regions-by-Adnan-Alkhalaf.pdf
    • http://cefasfese.4pu.com/2731736738738738/Weaving-the-Strands-Rosemont-Saga-2-by-Barbara-Hinske.pdf
    • http://cefasfese.4pu.com/5730730738730733/Weaving-His-Art-on-Golden-Looms-Paintings-and-Drawings-by-Art-Rosenbaum-by-Dennis-Harper.pdf
    • http://cefasfese.4pu.com/1730733731735730733/Mabel-McKay-Weaving-the-Dream-Portraits-of-American-Genius-1-by-Greg-Sarris.pdf
    • http://cefasfese.4pu.com/1731730735735739739/The-Norwegian-Fjords-by-A-Heaton-Cooper.pdf
    • http://cefasfese.4pu.com/1730735731730734733/Norwegian-Woody-Let-It-Beatle-4-by-J-D-Walker.pdf
    • http://cefasfese.4pu.com/3732733736736/Norwegian-Wood-by-Haruki-Murakami.pdf
    • http://cefasfese.4pu.com/3735732739738732/Norwegian-Wood-by-Haruki-Murakami.pdf
    • http://cefasfese.4pu.com/8731739733731735/Norwegian-Wood-by-Haruki-Murakami.pdf
    • http://cefasfese.4pu.com/1731730735735733736/Cruising-The-Norwegian-Fjords-by-Brian-Anderson.pdf
    • http://cefasfese.4pu.com/9732738731731739/Weaving-Designs-by-Bertha-Gray-Hayes-Miniature-Overshot-Patterns-by-Weavers-Guild-of-Rhode-Island.pdf
    • http://cefasfese.4pu.com/8734737738738735/Norwegian-by-Night-Sigrid-deg-rd-1-by-Derek-B-Miller.pdf
    • http://cefasfese.4pu.com/1731730735736736732/The-Norwegian-Fjords-Painted-and-Described-by-Alfred-Heaton-Cooper.pdf
    • http://cefasfese.4pu.com/1731733739731735732/The-Potential-of-Cross-Marketing-for-the-Destination-Management-Organizations-of-New-York-City-and-New-York-State-by-Yvonne-Koppen.pdf
    • http://cefasfese.4pu.com/473473673

Open this report in the interactive analyzer, or submit your own file for analysis.