Malicious PDF — malware analysis report

Static analysis result for SHA-256 00d2708e9e056d91…

MALICIOUS

PDF

14.3 KB Created: 2019-05-02 07:44:07 +01:00 Authoring application: mPDF 5.7
MD5: 03ffa3990c0ec342534dd234d33922d4 SHA-1: ace3c22ddf7b7a5a1ce2949f318f13fd5886c47d SHA-256: 00d2708e9e056d91b1608d672739a31f015febd5bb809e13753d17a3dbf60ff3
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

This PDF document contains a large number of embedded links to external PDF files, identified by the PDF_SEO_LINK_FARM heuristic. While most of these links are currently classified as benign, the sheer volume and the nature of the heuristic suggest a potential attempt at SEO manipulation or a distribution point for further malicious content. The ML classifier also flagged this document as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/5731736736739/Ghost-House-The-Ghost-House-Saga-1-by-Alexandra-Adornetto.pdf
    • http://cefasfese.4pu.com/3735733737736737/Giving-Up-the-Ghost-Laying-a-Ghost-2-by-Jane-Davitt.pdf
    • http://cefasfese.4pu.com/3735732731732737/Laying-a-Ghost-Laying-a-Ghost-1-by-Jane-Davitt.pdf
    • http://cefasfese.4pu.com/3738731737730739/Gus-And-The-Baby-Ghost-by-Jane-Thayer.pdf
    • http://cefasfese.4pu.com/3731731737738734/Gus-Was-A-Friendly-Ghost-by-Jane-Thayer.pdf
    • http://cefasfese.4pu.com/3739737735732733/Gus-Was-a-Friendly-Ghost-by-Jane-Thayer.pdf
    • http://cefasfese.4pu.com/2731730739737733/Ghost-House-by-Hannah-Faith-Notess.pdf
    • http://cefasfese.4pu.com/3738732731731739/Ghost-in-the-House-by-Ammi-Joan-Paquette.pdf
    • http://cefasfese.4pu.com/2732730732730733/Ghost-House-Book-One-by-Dani-R-R-Hermit.pdf
    • http://cefasfese.4pu.com/5732736733733733/The-Ghost-House-Annie-Graham-1-by-Helen-Phifer.pdf
    • http://cefasfese.4pu.com/8735736732731/The-Haunted-Dolls-House-and-Other-Ghost-Stories-by-M-R-James.pdf
    • http://cefasfese.4pu.com/2732736736737733/The-Ghost-at-Dawn-s-House-The-Baby-Sitters-Club-9-by-Ann-M-Martin.pdf
    • http://cefasfese.4pu.com/1739734734738738/The-Ghost-of-Marlow-House-Haunting-Danielle-1-by-Bobbi-Holmes.pdf
    • http://cefasfese.4pu.com/1733735735733733/Happy-House-by-Jane-D-Abbott.pdf
    • http://cefasfese.4pu.com/3733738739736730/Lady-Jane-Grey-and-the-House-of-Suffolk-by-Alison-Plowden.pdf
    • http://cefasfese.4pu.com/1730738733735733731/Once-in-a-Lifetime-The-Crazy-Days-of-Acid-House-and-Afterwards-by-Jane-Bussmann.pdf
    • http://cefasfese.4pu.com/9735735737733736/The-House-of-Closed-Doors-The-House-of-Closed-Doors-1-by-Jane-Steen.pdf
    • http://cefasfese.4pu.com/3735738732732734/Asylum-by-Isobel-Blackthorn.pdf
    • http://cefasfese.4pu.com/1739731732737737/The-Drago-Tree-by-Isobel-Blackthorn.pdf
    • http://cefasfese.4pu.com/3736736730736733/A-Perfect-Square-by-Isobel-Blackthorn.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.