Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bf5c54c675b98b2…

MALICIOUS

PDF

16.5 KB Created: 2019-06-10 04:51:04 +01:00 Authoring application: mPDF 5.7
MD5: 1038c4341623cf23d220ee05397b253b SHA-1: 5fbc42ec9fdccd265e0a8bedaaad0b488d6797b7 SHA-256: 1bf5c54c675b98b26ac5964d586377357f3ece520777517446dec827a137dfce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a lure to a large collection of potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4734733735732737/No-Good-Deed-Mark-Taylor-1-by-M-P-McDonald.pdf
    • http://cefasfese.4pu.com/7732734731736/One-Good-Deed-by-Andrew-Grey.pdf
    • http://cefasfese.4pu.com/4736739734738734/No-Good-Deed-by-John-Niven.pdf
    • http://cefasfese.4pu.com/2734735736731732/No-Good-Deed-by-Russel-K-Stevens.pdf
    • http://cefasfese.4pu.com/2731739734732733/No-Good-Deed-by-Kara-Connolly.pdf
    • http://cefasfese.4pu.com/1737730730738/No-Good-Deed-by-Manda-Scott.pdf
    • http://cefasfese.4pu.com/7730735733739737/One-Good-Deed-365-Days-of-Trying-to-Be-Just-a-Little-Bit-Better-by-Erin-McHugh.pdf
    • http://cefasfese.4pu.com/4735731731737734/No-Good-Deed-Lucy-Kincaid-10-by-Allison-Brennan.pdf
    • http://cefasfese.4pu.com/4731735736736733/Blackwing-Raven-s-Mark-1-by-Ed-McDonald.pdf
    • http://cefasfese.4pu.com/3732736732730733/Ravencry-Raven-s-Mark-2-by-Ed-McDonald.pdf
    • http://cefasfese.4pu.com/1730735737731734733/Rewiring-the-Real-In-Conversation-with-William-Gaddis-Richard-Powers-Mark-Danielewski-and-Don-Delillo-by-Mark-C-Taylor.pdf
    • http://cefasfese.4pu.com/4738731731731738/The-Shyest-Kid-in-the-Patch-by-Mark-Taylor.pdf
    • http://cefasfese.4pu.com/4730730734733735/The-Case-of-the-Purloined-Compass-by-Mark-Taylor.pdf
    • http://cefasfese.4pu.com/4734737738738733/Speed-Limits-Where-Time-Went-and-Why-We-Have-So-Little-Left-by-Mark-C-Taylor.pdf
    • http://cefasfese.4pu.com/2733732734736735/Gone-for-Good-by-Mark-Childress.pdf
    • http://cefasfese.4pu.com/1735733739734734/Good-As-Dead-by-Mark-Billingham.pdf
    • http://cefasfese.4pu.com/1739739737736731/Essequibo-Poems-by-Ian-McDonald-by-Ian-McDonald.pdf
    • http://cefasfese.4pu.com/2732731731731730/Good-As-Dead-Tom-Thorne-10-by-Mark-Billingham.pdf
    • http://cefasfese.4pu.com/3736735735739734/Up-Down-or-Sideways-How-to-Succeed-When-Times-Are-Good-Bad-or-in-Between-by-Mark-Sanborn.pdf
    • http://cefasfese.4pu.com/4736730735736732/Upside-Down-How-the-Left-has-Made-Right-Wrong-Truth-Lies-and-Good-Bad-by-Mark-Davis.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.