Malicious PDF — malware analysis report

Static analysis result for SHA-256 380c7145cd3cd40e…

MALICIOUS

PDF

15.6 KB Created: 2019-05-03 07:42:07 +01:00 Authoring application: mPDF 5.7
MD5: c827629d3209268af58780805f3d146e SHA-1: e2f7ccb7883fa31e9e2aea6b2a577be93c2c2e94 SHA-256: 380c7145cd3cd40e8b5477ad42d5d587c60ef7f94f598c1a4e316001998b71e4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this document as malicious. The primary attack pattern involves directing users to a suspicious domain hosting numerous files, likely as a lure or to bypass initial detection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730730735735737734/My-Little-Pony-Meet-the-Ponies-of-Ponyville-by-Olivia-London.pdf
    • http://cefasfese.4pu.com/4731737734733739/No-Ponies-in-the-House-Pony-Pals-37-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/9730736733731732/Pony-POV-Series-Discorded-Ponies-Side-Story-by-KnightMysterio.pdf
    • http://cefasfese.4pu.com/4736736730734737/The-Palomino-Pony-Rides-Out-The-Palomino-Pony-2-by-Olivia-Tuffin.pdf
    • http://cefasfese.4pu.com/3732733739732739/Love-and-War-in-London-The-Mass-Observation-Wartime-Diary-of-Olivia-Cockett-by-Olivia-Cockett.pdf
    • http://cefasfese.4pu.com/3734732736731735/Scandal-of-the-Year-Heiress-in-London-3-by-Olivia-Drake.pdf
    • http://cefasfese.4pu.com/1738731732734731/Jill-Enjoys-Her-Ponies-Jill-s-Ponies-4-by-Ruby-Ferguson.pdf
    • http://cefasfese.4pu.com/4736737730737733/The-Fourth-Pony-Pal-Pony-Pals-Super-Special-4-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736737730736737/The-Pony-and-the-Haunted-Barn-Pony-Pals-36-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736736739734732/The-Pony-and-the-Lost-Swan-Pony-Pals-34-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736736730737733/Movie-Star-Pony-Pony-Pals-26-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/1730730735734735738/The-Wild-Pony-Pony-Pals-9-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/1730730735736732731/What-s-Wrong-with-My-Pony-Pony-Pals-33-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736737730738736/The-Lonely-Pony-Pony-Pals-25-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/1730730735735735738/The-Winning-Pony-Pony-Pals-21-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4731737734733734/Pony-to-the-Rescue-Pony-Pals-5-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/2733739739735733/The-Saddest-Pony-Pony-Pals-18-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/1730730735735736731/Western-Pony-Pony-Pals-22-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4731737734733738/A-Pony-in-Trouble-Pony-Pals-3-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736736739735735/The-Magic-Pony-Pony-Pals-35-by-Jeanne-Betancourt.pdf
    • http://cefasfese.4pu.com/4736736739734732/The-Pony-and-the-Lost-Swan-Pony-Pals-34-by-Jeanne-Betancourt

Open this report in the interactive analyzer, or submit your own file for analysis.