Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff647674b3901211…

MALICIOUS

PDF

18.0 KB Created: 2019-11-21 12:47:19 +00:00 Authoring application: mPDF 5.7
MD5: 7a5d74a2b5c6220344ce441006c2c80b SHA-1: 59e9343491f99416aab82128876ae137389740fd SHA-256: ff647674b3901211d7653abc26cb9b6e8334270880096adb720f3a2554ec9d27
60 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign content, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to serve as a lure for further malicious activity. The embedded URLs are reconstructed from the document's annotation data.

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731738736738734733/Stern-in-der-Ferne-by-Roberto-Bola-o.pdf
    • http://cefasfese.4pu.com/9738738739733730/Mutma-ungen-ber-die-Herkunft-der-M-llerfamilie-Stern-in-der-Neumark-um-1800-Chronik-des-Familienzweiges-Stern-Teil-I-by-Carsten-Stern.pdf
    • http://cefasfese.4pu.com/3731731731738732/Sam-Stern-s-Student-Cookbook-Survive-in-Style-on-a-Budget-by-Sam-Stern.pdf
    • http://cefasfese.4pu.com/9731733730738730/The-Economics-of-Climate-Change-The-Stern-Review-by-Nicholas-Stern.pdf
    • http://cefasfese.4pu.com/7731731731735732/Recados-da-Bola-Depoimentos-de-doze-mestres-do-futebol-brasileiro-by-Jorge-Vasconcelos.pdf
    • http://cefasfese.4pu.com/1731738737730734730/In-der-Ferne-das-Nordreich-by-Elan-Moor.pdf
    • http://cefasfese.4pu.com/1731738737730734736/Tr-ume-aus-der-Ferne-by-Alexandra-Liebert.pdf
    • http://cefasfese.4pu.com/1731738737730734733/Reise-in-die-Ferne-by-Daniel-Rainer.pdf
    • http://cefasfese.4pu.com/1731738737730734731/JEREMY-Liebe-in-der-Ferne-by-Andrew-Summers.pdf
    • http://cefasfese.4pu.com/1731738737730733738/-bers-Meer-in-die-Ferne-by-Gregor-Gumpert.pdf
    • http://cefasfese.4pu.com/1731738736737736732/Greene-Ferne-Farm-by-Richard-Jefferies.pdf
    • http://cefasfese.4pu.com/1731732737732734739/Ferne-Stimmen-in-Ihrer-N-he-by-Dal-Ja-Shin.pdf
    • http://cefasfese.4pu.com/1731738736739738732/Adventure-Guide-to-Provence-amp-the-Cote-D-Azur-by-Ferne-Arfin.pdf
    • http://cefasfese.4pu.com/1731738736739738731/Easy-RV-Recipes-Recipes-for-the-Traveling-Cook-by-Ferne-Holmes.pdf
    • http://cefasfese.4pu.com/1731738736738735733/The-Resolving-of-Conscience-Upon-This-Question-Whether-Upon-Such-a-Supposition-or-Case-as-Is-Now-Usually-Made-Subjects-May-Take-Arms-and-Resist-and-Whether-That-Be-the-Case-Now-By-H-Fern-1642-by-Ferne.pdf
    • http://cefasfese.4pu.com/4733739730730736/The-Punisher-by-D-A-Stern.pdf
    • http://cefasfese.4pu.com/2733732731731733/I-Don-t-Know-Do-You-by-Roberto-Montes.pdf
    • http://cefasfese.4pu.com/9735730737738739/Verkauft-by-Sophie-Stern.pdf
    • http://cefasfese.4pu.com/9731733730738731/The-Pinch-by-Steve-Stern.pdf
    • http://cefasfese.4pu.com/2732734734738736/Stern-Men-by-Elizabeth-Gilbert.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.