Malicious PDF — malware analysis report

Static analysis result for SHA-256 31f5e32b6f3acaa8…

MALICIOUS

PDF

20.4 KB Created: 2019-06-09 14:54:39 +01:00 Authoring application: mPDF 5.7
MD5: 1fa4142d444dbc56def84f277cb27715 SHA-1: d46f043d56d9cc4b64c73f371bdb2558919377ff SHA-256: 31f5e32b6f3acaa8720ca6bb9184e80333b2ea984d05153d67d2c770841679b0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily obfuscated, the presence of numerous URLs suggests a link-farming or redirection scheme. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9805

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/3734739734736/I-m-a-Stranger-Here-Myself-Notes-on-Returning-to-America-After-Twenty-Years-Away-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/4738738736737734/I-m-a-Stranger-Here-Myself-Notes-on-Returning-to-America-After-Twenty-Years-Away-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/9730733738730731/I-m-a-Stranger-Here-Myself-Notes-on-Returning-to-America-After-Twenty-Years-Away-Unabridged-Audible-Audio-Edition-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1735739735737735/I-m-a-Stranger-Here-Myself-Notes-on-Returning-to-America-After-20-Years-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/4737734730731735/Notes-From-A-Big-Country-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1739735736/The-Road-to-Little-Dribbling-More-Notes-From-a-Small-Island-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1735733736735731/One-Summer-America-1927-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1739733731734739/Seeing-Further-Ideas-Endeavours-Discoveries-and-Disputes-The-Story-of-Science-Through-350-Years-of-the-Royal-Society-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/8732735731731/Fire-in-the-Ashes-Twenty-Five-Years-Among-the-Poorest-Children-in-America-by-Jonathan-Kozol.pdf
    • http://cefasfese.4pu.com/3735733732731734/Shakespeare-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/5730730739737735/The-Lost-Continent-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/6731733737734/A-Really-Short-History-of-Nearly-Everything-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/4736732732730731/Neither-here-Nor-there-Travels-in-Europe-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/3733739730737/In-a-Sunburned-Country-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/2738735730731737/Life-and-Times-of-the-Thunderbolt-Kid-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/3738734735731/The-Mother-Tongue-English-and-How-It-Got-That-Way-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/2738735734737738/At-Home-A-Short-History-of-Private-Life-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1738736733738734/The-Life-and-Times-of-the-Thunderbolt-Kid-Travels-through-My-Childhood-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/4737736730733736/At-Home-A-Short-History-of-Private-Life-by-Bill-Bryson.pdf
    • http://cefasfese.4pu.com/1737737737739733/The-Mother-Tongue-by-Bill-Bryson-Summary-amp-Study-Guide-by-BookRags.pdf
    • http://cefasfese.4pu.com/4737734730731735/Notes-From-A-Big-Countr

Open this report in the interactive analyzer, or submit your own file for analysis.