Malicious PDF — malware analysis report

Static analysis result for SHA-256 39ca1fabc5f8415f…

MALICIOUS

PDF

14.6 KB Created: 2019-11-09 23:40:01 +00:00 Authoring application: mPDF 5.7
MD5: 2bc967c15e71dd3c07c19500f3112df1 SHA-1: 93931d62f84cdc37eafe34966952db4b430bec15 SHA-256: 39ca1fabc5f8415f77ea182dd74c635a200ec0e801e82f6eda2088e9fa721c2b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to adult content websites. The ML_NYX_PDF_MALICIOUS heuristic also flagged this PDF with a high confidence score. While no scripts were extracted, the sheer volume of external links suggests a malicious intent to redirect users to potentially harmful or unwanted content, possibly as part of a link-farming or click fraud scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9737732737733732/Flat-Tits-456-Perky-Nipples-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737733736/Mammal-Tits-456-Big-Boobs-by-Nuart.pdf
    • http://cefasfese.4pu.com/5737734732737/Flat-Out-Celeste-Flat-Out-Love-2-by-Jessica-Park.pdf
    • http://cefasfese.4pu.com/9737732735732735/Dream-Tits-456-by-Eros.pdf
    • http://cefasfese.4pu.com/8738730736731/Why-Do-Men-Have-Nipples-by-Vicar-Michael.pdf
    • http://cefasfese.4pu.com/3739739736735733/Perky-Girl-The-Amazing-Life-of-Bienna-Molo-by-Vera-I-Roberts.pdf
    • http://cefasfese.4pu.com/2730734739733734/Why-Do-Men-Have-Nipples-Hundreds-of-Questions-You-d-Only-Ask-a-Doctor-After-Your-Third-Martini-by-Mark-Leyner.pdf
    • http://cefasfese.4pu.com/9737732737738734/Nude-Butts-456-Sexy-Ass-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737737738/Love-Dolls-456-Only-Teens-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737732738/Erotic-1900-456-Old-Pussy-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737732730/Hairy-Latina-456-Spanish-Pussy-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737738732/Naked-Yoga-456-Stretched-Pussies-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737732735/Pregnant-and-Horny-456-Oversized-Pussy-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737737733/Hitchhiking-Whores-456-Outdoor-Sluts-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737733734/Slave-Girls-456-Tied-Pussies-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737737731/Erotic-Voyeur-456-Outdoor-Pussy-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737737735/Japan-Striptease-456-Uncensored-Pussies-by-Nuart.pdf
    • http://cefasfese.4pu.com/9737732737736738/Japan-Bondage-456-Tied-Pussy-by-Nuart.pdf
    • http://cefasfese.4pu.com/2732734735734736/The-Cat-on-the-Mat-Is-Flat-by-Andy-Griffiths.pdf
    • http://cefasfese.4pu.com/1734736730731736/Running-Flat-by-Eric-Maywar.pdf
    • http://cefasfese.4pu.com/97377327377387

Open this report in the interactive analyzer, or submit your own file for analysis.