Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d4fdb55671c108c…

MALICIOUS

PDF

16.5 KB Created: 2019-11-07 09:29:17 +00:00 Authoring application: mPDF 5.7
MD5: 2645570ccac7bd6b944ef9fd0fd2b239 SHA-1: d525dc094a8bb14298b1441f39d452509665f0bc SHA-256: 3d4fdb55671c108c8b86942e7349161721cb4d93f9078c5dca9a5b761be8e5bf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign-looking book titles, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely to manipulate search engine results or host malicious content. The primary attack pattern involves leveraging these links for a malicious purpose.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/6738734739735734/Craig-amp-Fred-A-Marine-A-Stray-Dog-and-How-They-Rescued-Each-Other-by-Craig-Grossi.pdf
    • http://cefasfese.4pu.com/5739735733739739/The-P-Craig-Russell-Library-of-Opera-Adaptations-Vol-3-Pelleas-and-Melisande-Salome-Ein-Heldentraum-Cavalleria-Rusticana-by-P-Craig-Russell.pdf
    • http://cefasfese.4pu.com/8731739731732737/Best-of-Craig-Claiborne-1-000-Recipes-from-His-New-York-Times-Food-Columns-and-Four-of-His-Classic-Cookbooks-by-Craig-Claiborne.pdf
    • http://cefasfese.4pu.com/8731738738730734/Craig-Claiborne-s-a-Feast-Made-for-Laughter-by-Craig-Claiborne.pdf
    • http://cefasfese.4pu.com/1731732736737739/One-On-One-by-Craig-Brown.pdf
    • http://cefasfese.4pu.com/5730734739739737/Oh-Sh-t-What-Now-by-Craig-Oldham.pdf
    • http://cefasfese.4pu.com/5738735730734731/Zak-And-Ben-by-Craig-L-Tweedt.pdf
    • http://cefasfese.4pu.com/4736738734734739/Nowhere-Man-by-Jamie-Craig.pdf
    • http://cefasfese.4pu.com/3735737735736739/Not-Before-Bed-by-Craig-Hallam.pdf
    • http://cefasfese.4pu.com/9739737730733733/Blackouts-by-Craig-Boyko.pdf
    • http://cefasfese.4pu.com/2739734731734733/The-Seven-Torments-of-Amy-and-Craig-by-Don-Zolidis.pdf
    • http://cefasfese.4pu.com/7738738736731737/The-Second-Winter-by-Craig-Larsen.pdf
    • http://cefasfese.4pu.com/4737734736732733/The-Empowered-by-Craig-Parshall.pdf
    • http://cefasfese.4pu.com/1730737733732734734/Strand-by-Craig-Dworkin.pdf
    • http://cefasfese.4pu.com/2737732731731737/Altar-Ego-Becoming-Who-God-Says-You-Are-by-Craig-Groeschel.pdf
    • http://cefasfese.4pu.com/4734731735731739/The-Sell-in-by-Craig-Mathieson.pdf
    • http://cefasfese.4pu.com/5735730737730737/Resistance-by-Craig-Simpson.pdf
    • http://cefasfese.4pu.com/4737737733732737/Level-Up-by-Craig-Anderson.pdf
    • http://cefasfese.4pu.com/1739739736739734/Wetware-by-Craig-Nova.pdf
    • http://cefasfese.4pu.com/2732739737736734/Treed-by-Craig-McGray.pdf
    • http://cefasfese.4pu.com/573

Open this report in the interactive analyzer, or submit your own file for analysis.