Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ce416aa2f902181…

MALICIOUS

PDF

16.9 KB Created: 2019-06-04 09:41:02 +01:00 Authoring application: mPDF 5.7
MD5: 27b7919790a1bcc68a4b3bb9f2d32169 SHA-1: 58e35e163731515b8c4b1f7bf801d3fbe8367ee7 SHA-256: 1ce416aa2f9021810067bf20323a3257def4457101c2e13199d10c4feb78d0e4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, likely to manipulate search engine results or redirect users to harmful sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9788

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9735733736738736/Frei-und-gef-hrlich-Die-Macht-der-Narren-by-Klaus-Werner-Lobo.pdf
    • http://cefasfese.4pu.com/1730736734734734739/Kaya---frei-und-stark-Kaya-7-9-Sammelband-zum-Sonderpreis-Kaya-gibt-alles-Kaya-schw-rt-Rache-Kaya-rettet-Fohlen-Frei-wie-der-Wind-65346-by-Gaby-Hauptmann.pdf
    • http://cefasfese.4pu.com/1733732739736733/No-Going-Back-Jon-amp-Lobo-5-by-Mark-L-Van-Name.pdf
    • http://cefasfese.4pu.com/1731730735737738733/Slanted-Jack-Jon-amp-Lobo-2-by-Mark-L-Van-Name.pdf
    • http://cefasfese.4pu.com/1731735730734736733/Anweisungen-an-die-Krokodile-by-Ant-nio-Lobo-Antunes.pdf
    • http://cefasfese.4pu.com/1734730730736731/Knowledge-of-Hell-by-Ant-nio-Lobo-Antunes.pdf
    • http://cefasfese.4pu.com/3735730738730730/The-Natural-Order-of-Things-by-Ant-nio-Lobo-Antunes.pdf
    • http://cefasfese.4pu.com/2734730739735/Klaus-Klaus-vol-1-by-Grant-Morrison.pdf
    • http://cefasfese.4pu.com/9735733735733738/Heilige-Narren-22-Lebensbilder-by-Ulrich-Holbein.pdf
    • http://cefasfese.4pu.com/9735733735733730/Narren-Gaukler-Harlekine-by-Sieger-Koder.pdf
    • http://cefasfese.4pu.com/9735733736730732/The-Narren-Motifs-in-the-Works-of-Georg-Buechner-by-Leslie-Mac-Ewen.pdf
    • http://cefasfese.4pu.com/1730738735731736734/Klaus-Merkel-The-Reading-of-Time-in-the-Text-of-Nature-by-Klaus-Merkel.pdf
    • http://cefasfese.4pu.com/7734733738739/The-Klaus-Brothers-Boxed-Set-Klaus-Brothers-1-3-by-Penny-Watson.pdf
    • http://cefasfese.4pu.com/1730731733735738739/Wunder-Spott-Und-Prophetie-Nat-rliche-Narrheit-in-Den-historien-Von-Claus-Narren-by-Ruth-von-Bernuth.pdf
    • http://cefasfese.4pu.com/9737730730738737/Unsterblich-by-Frederike-Frei.pdf
    • http://cefasfese.4pu.com/1731730736734739738/Ein-Koffer-in-Berlin-by-Pierre-Frei.pdf
    • http://cefasfese.4pu.com/3739732738735/The-Stranger-The-Labyrinths-of-Echo-1-by-Max-Frei.pdf
    • http://cefasfese.4pu.com/2738732739734733/The-Stranger-s-Woes-The-Labyrinths-of-Echo-2-by-Max-Frei.pdf
    • http://cefasfese.4pu.com/8739734739736737/Frei-Geboren-E-L-win-In-2-Welten-by-Joy-Adamson.pdf
    • http://cefasfese.4pu.com/6734737739733737/Die-Mathematiker-an-Den-Zurcher-Hochschulen-by-G-nther-Frei.pdf
    • http://cefasfese.4pu.com/9735733736730732/The-Narren-Motifs-in-the-Works-of-Georg-Buechner-by-Leslie-Mac-E

Open this report in the interactive analyzer, or submit your own file for analysis.