Malicious PDF — malware analysis report

Static analysis result for SHA-256 04d7743ebe923967…

MALICIOUS

PDF

16.6 KB Created: 2019-08-02 07:38:15 +01:00 Authoring application: mPDF 5.7
MD5: 8785e29aaad67dd28aa220602eaa3bcf SHA-1: f97d17d7a88cfcec86f031642e3ec749c6636fc8 SHA-256: 04d7743ebe923967a709015c3a7f20d3f54c93fd962923f105e54d1f68af30e2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection to malicious content. ClamAV also detected this as Pdf.Dropper.Agent-7165658-0, indicating its dropper functionality. The embedded links likely lead to a second-stage payload or phishing site.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7165658-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7165658-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/6730735732736/Crow-by-Barbara-Wright.pdf
    • http://cefasfese.4pu.com/4734739737732731/Crow-by-Barbara-Wright.pdf
    • http://cefasfese.4pu.com/3730731733731734/For-Want-of-a-Fiend-by-Barbara-Ann-Wright.pdf
    • http://cefasfese.4pu.com/1735736739739738/The-Pyramid-Waltz-by-Barbara-Ann-Wright.pdf
    • http://cefasfese.4pu.com/2732730738731735/Barbara-Wright-Translation-as-Art-by-Debra-Kelly.pdf
    • http://cefasfese.4pu.com/2736734736734736/The-Johnny-Crow-Omnibus-Featuring-Johnny-Crow-s-Garden-Johnny-Crow-s-Party-and-Johnny-Crow-s-New-Garden-by-L-Leslie-Brooke.pdf
    • http://cefasfese.4pu.com/1732730736730/Eyes-of-Crow-Aspect-of-Crow-1-by-Jeri-Smith-Ready.pdf
    • http://cefasfese.4pu.com/3730733730739730/The-Crow-Girl-The-Children-of-Crow-Cove-by-Bodil-Bredsdorff.pdf
    • http://cefasfese.4pu.com/1734737738735731/The-Crow-Girl-The-Children-of-Crow-Cove-by-Bodil-Bredsdorff.pdf
    • http://cefasfese.4pu.com/9737736738730/Crow-Dog-Four-Generations-of-Sioux-Medicine-Men-by-Leonard-Crow-Dog.pdf
    • http://cefasfese.4pu.com/3735738735733738/Crow-The-Prequel-Crow-0-5-by-Alex-Owens.pdf
    • http://cefasfese.4pu.com/2732736736733735/Scare-Crow-Crow-s-Row-2-by-Julie-Hockley.pdf
    • http://cefasfese.4pu.com/3735733736739735/Crow-s-Row-Crow-s-Row-1-by-Julie-Hockley.pdf
    • http://cefasfese.4pu.com/2732736734738/Crow-s-Row-Crow-s-Row-1-by-Julie-Hockley.pdf
    • http://cefasfese.4pu.com/1731730737735735738/Doctor-Faustus-Christopher-Marlowe-Anne-Crow-by-Anne-Crow.pdf
    • http://cefasfese.4pu.com/2736735735730733/Crow-Girl-Returns-Crow-Girl-2-by-Kate-Cann.pdf
    • http://cefasfese.4pu.com/4735739730731733/Crow-Girl-Rises-Crow-Girl-3-by-Kate-Cann.pdf
    • http://cefasfese.4pu.com/9734737735/Wright-Brothers-Wrong-Story-How-Wilbur-Wright-Solved-the-Problem-of-Manned-Flight-by-William-Hazelgrove.pdf
    • http://cefasfese.4pu.com/2734732735733737/The-Wright-One-Wright-Love-Duet-2-by-K-A-Linde.pdf
    • http://cefasfese.4pu.com/9738731735739738/Frank-Lloyd-Wright-Chicagoland-Frank-Lloyd-Wright-Portfolio-Series-by-Thomas-A-Heinz.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.