Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe7b6b21701a6e29…

MALICIOUS

PDF

18.0 KB Created: 2019-05-05 15:59:28 +01:00 Authoring application: mPDF 5.7
MD5: 72ccb4bf6b8b4444e2f9d2408af37152 SHA-1: 22aa2ce29a1ee96c7329fdbfbe87966392860c9c SHA-256: fe7b6b21701a6e2917b052d9f108a4d73906d44262a6e484c64ce50106075dd2
60 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles hosted on the `xiixmcuin.linkpc.net` domain. While the URLs themselves are marked as benign, the sheer volume and the nature of the heuristic suggest a link farm or SEO manipulation tactic. No scripts were extracted from this sample. The attack pattern is inferred from the link farm heuristic.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/4206209200202208/Chessmen-of-Doom-The-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/2200208205206204/The-Best-of-John-Bellairs-The-House-with-a-Clock-in-Its-Walls-The-Figure-in-the-Shadows-The-Letter-the-Witch-and-the-Ring-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/3201202201200207/The-Face-in-the-Frost-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/3204209204202201/The-Ghost-in-the-Mirror-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/1204200206204/The-Mummy-the-Will-and-the-Crypt-Johnny-Dixon-2-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/2204204203207204/The-Figure-in-the-Shadows-Lewis-Barnavelt-2-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/4206209200201202/The-Spell-of-the-Sorcerer-s-Skull-Johnny-Dixon-3-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/1208201201208202/The-Mansion-in-the-Mist-Anthony-Monday-Mysteries-4-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/1200205208205200/The-House-with-a-Clock-in-Its-Walls-Lewis-Barnavelt-1-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/1208204204202203/The-Curse-of-the-Blue-Figurine-Johnny-Dixon-1-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/3204209204200205/The-Vengeance-of-the-Witch-Finder-Lewis-Barnavelt-5-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/4206208202200208/The-Curse-of-the-Blue-Figurine-Johnny-Dixon-1-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/4205201201206204/The-House-with-a-Clock-in-Its-Walls-Lewis-Barnavelt-1-by-John-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/3203206200200202/Traitor-s-Doom-Dr-Palfrey-1-by-John-Creasey.pdf
    • http://xiixmcuin.linkpc.net/5204200209208200/Susie-Sadly-and-the-Black-Torpedo-of-Doom-by-John-S-Littell.pdf
    • http://xiixmcuin.linkpc.net/3205209206209208/The-Divas-of-Doom-Doom-Divas-2-by-Sherry-M-Siska.pdf
    • http://xiixmcuin.linkpc.net/4204206203204205/Ivory-Vikings-The-Mystery-of-the-Most-Famous-Chessmen-in-the-World-and-the-Woman-Who-Made-Them-by-Nancy-Marie-Brown.pdf
    • http://xiixmcuin.linkpc.net/7204200209207201/The-Lewis-Trilogy-The-Blackhouse-The-Lewis-Man-The-Chessmen-by-Peter-May.pdf
    • http://xiixmcuin.linkpc.net/9209204201209208/Cell-Behaviour-A-Tribute-to-Michael-Abercrombie-by-Ruth-Bellairs.pdf
    • http://xiixmcuin.linkpc.net/5206203206201203/A-Princess-of-Mars-Gods-of-Mars-Warlord-of-Mars-Thuvia-Maid-of-Mars-Chessmen-of-Mars-Master-Mind-of-Mars-Fighting-Man-of-Mars-Barsoom-1-7-by-Edgar-Rice-Burroughs.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.