Malicious PDF — malware analysis report

Static analysis result for SHA-256 240f5e67e3368961…

MALICIOUS

PDF

17.7 KB Created: 2019-11-09 21:46:09 +00:00 Authoring application: mPDF 5.7
MD5: 17dfffd292a20cc6d9bfb1cd0d15e843 SHA-1: a5f2ddcb90da3b7b9208d053273f9d3fb0158b45 SHA-256: 240f5e67e33689610f1833701b1e5221064718acb4f96b342b6180455ad3ab64
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a link farm with 25 external links, all pointing to the same domain 'cefasfese.4pu.com'. This heuristic indicates a likely attempt to drive traffic to malicious or spam content. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4739735734733738/The-Arabian-Nights-Tales-of-1001-Nights-Volume-2-by-Anonymous.pdf
    • http://cefasfese.4pu.com/4739735734734730/The-Arabian-Nights-Tales-of-1001-Nights-Volume-3-by-Anonymous.pdf
    • http://cefasfese.4pu.com/4732734735733732/The-1001-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/9730734738737734/Tales-from-The-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/7735730734734739/The-Arabian-Nights-Entertainments-Or-The-Book-of-a-Thousand-Nights-and-a-Night-by-Anonymous.pdf
    • http://cefasfese.4pu.com/1731734739731737736/The-Book-of-the-Thousand-Nights-and-a-Night-also-called-The-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/3730732735734732/Arabian-Nights-The-Marvels-and-Wonders-of-The-Thousand-and-One-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/5737733731730739/Tales-from-the-Arabian-Nights-Sheherazade-Aladdin-Ali-Baba-and-the-40-Thieves-by-Anonymous.pdf
    • http://cefasfese.4pu.com/9734732733737/1001-Nights-Illustrated-Fairy-Tales-from-One-Thousand-and-One-Nights-by-Robert-Klanten.pdf
    • http://cefasfese.4pu.com/4736735735734732/The-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/4730731733730738/The-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/9737736730739737/The-Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/9739739732731739/Arabian-Nights-by-Anonymous.pdf
    • http://cefasfese.4pu.com/9738734732738732/The-Arabian-Nights-Entertainment-by-Anonymous.pdf
    • http://cefasfese.4pu.com/1735739736732738/The-Arabian-Nights-Entertainments-by-Anonymous.pdf
    • http://cefasfese.4pu.com/3730736736734739/Sharaz-De-Tales-from-the-Arabian-Nights-by-Sergio-Toppi.pdf
    • http://cefasfese.4pu.com/2735738737735736/The-Arabian-Nights-Alf-Laylah-Wa-Laylah-by-Anonymous.pdf
    • http://cefasfese.4pu.com/4738732736730736/101-Nights-Volume-One-101-Nights-1-3-by-S-E-Reign.pdf
    • http://cefasfese.4pu.com/1731731737731731/One-Thousand-and-One-Arabian-Nights-by-Geraldine-McCaughrean.pdf
    • http://cefasfese.4pu.com/1730732735730731/New-Arabian-Nights-by-Robert-Louis-Stevenson.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.