Malicious PDF — malware analysis report

Static analysis result for SHA-256 29c9f044d6b7dd72…

MALICIOUS

PDF

22.9 KB Created: 2019-05-04 06:39:16 +01:00 Authoring application: mPDF 5.7 First seen: 2021-08-25
MD5: ebcd45b23b662523d5cdde2c617eb368 SHA-1: 7c48dfb07e6165c2b48673863189ebbaa2a21944 SHA-256: 29c9f044d6b7dd72002794d72388a110132aaccbac6abd7fb61d09b04376e5f8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are marked as benign, the sheer volume and the heuristic firing of 'PDF_SEO_LINK_FARM' suggest a malicious intent to manipulate search engine results or redirect users to potentially harmful content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9784

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4730738735736735/Third-class-in-Indian-railways-by-Mahatma-Gandhi.pdf In PDF document text
    • http://cefasfese.4pu.com/4734733730733/A-Dance-to-the-Music-of-Time-Complete-Set-1st-Movement-2nd-Movement-3rd-Movement-4th-Movement-by-Anthony-Powell.pdfIn PDF document text
    • http://cefasfese.4pu.com/1735734732731732/The-Essential-Gandhi-An-Anthology-of-His-Writings-on-His-Life-Work-and-Ideas-by-Mahatma-Gandhi.pdfIn PDF document text
    • http://cefasfese.4pu.com/4739730730731735/Two-Alone-Two-Together-Letters-Between-Indira-Gandhi-amp-Jawaharlal-Nehru-1940-64-by-Sonia-Gandhi.pdfIn PDF document text
    • http://cefasfese.4pu.com/8732730732739732/Credo-for-the-American-Indian-Movement-A-I-M-International-Chapters-and-Divisions-on-a-Worldwide-Level-by-Marcella-Loyer.pdfIn PDF document text
    • http://cefasfese.4pu.com/3736737736734731/In-the-Spirit-of-Crazy-Horse-The-Story-of-Leonard-Peltier-and-the-FBI-s-War-on-the-American-Indian-Movement-by-Peter-Matthiessen.pdfIn PDF document text
    • http://cefasfese.4pu.com/4731735730737734/Agents-of-Repression-The-FBI-s-Secret-Wars-against-the-Black-Panther-Party-amp-the-American-Indian-Movement-by-Ward-Churchill.pdfIn PDF document text
    • http://cefasfese.4pu.com/4737734738733731/Bhagavad-Gita-According-to-Gandhi-by-Mahatma-Gandhi.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731736731730735738/-An-Autobiography-or-the-Story-of-My-Experiments-with-Truth-Author-Mahatma-Gandhi-Jun-2007-by-Mahatma-Gandhi.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731733737733735734/Movement-Is-Fun-A-Preschool-Movement-Program-by-Susan-B-Young.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730731730733736734/Mom-s-Cooking-and-More-Indian-Style-Indian-Cuisine-and-Culture-by-Anila-Bali.pdfIn PDF document text
    • http://cefasfese.4pu.com/2731731732730737/Tears-of-internment-The-Indian-history-of-Fox-Island-and-the-Puget-Sound-Indian-War-by-Cecelia-Svinth-Carpenter.pdfIn PDF document text
    • http://cefasfese.4pu.com/2734734731735734/The-Secret-of-the-Indian-The-Indian-in-the-Cupboard-3-by-Lynne-Reid-Banks.pdfIn PDF document text
    • http://cefasfese.4pu.com/6731733733735737/L-ind-pendance-maintenant-by-Various.pdfIn PDF document text
    • http://cefasfese.4pu.com/6730735734738737/Independance-2011-by-Gra-Bouguy.pdfIn PDF document text
    • http://cefasfese.4pu.com/3730738739737733/The-Movement-of-Crowns-Movement-of-Crowns-1-by-Nadine-C-Keels.pdfIn PDF document text
    • http://cefasfese.4pu.com/6730735735731738/The-Mexican-War-of-Independance-by-Bruno-Leone.pdfIn PDF document text
    • http://cefasfese.4pu.com/6730735734739732/Ind-pendance-Les-conditions-du-renouveau-by-Mathieu-Bock-C-t-.pdfIn PDF document text
    • http://cefasfese.4pu.com/6736734739730735/The-Empire-Crystal-by-Malika-Gandhi.pdfIn PDF document text
    • http://cefasfese.4pu.com/4730739731731738/The-Men-Who-Killed-Gandhi-by-Manohar-Malgonkar.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.