Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d9fb298ba29655d…

MALICIOUS

PDF

19.0 KB Created: 2019-05-03 05:53:30 +01:00 Authoring application: mPDF 5.7 First seen: 2020-12-25
MD5: c444524190eb39527b093e163ef9555e SHA-1: 282969eab1d288554e7fd57c659e1ce98b57c612 SHA-256: 3d9fb298ba29655d71cae25680e4396c9bd37f230ba619ce5978f5cd6424dd60
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or SEO poisoning tactic, likely intended to drive traffic to malicious or low-quality content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4738735733737/Selected-Poems-by-Langston-Hughes.pdf In PDF document text
    • http://cefasfese.4pu.com/4739730730730730/Vintage-Hughes-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/1738737739735730/The-Dream-Keeper-Dream-Keeper-Chronicles-1-by-Mikey-Brooks.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739730732736738/Sail-Away-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734734737733730/The-Panther-and-the-Lash-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734734739732732/Laughing-to-Keep-from-Crying-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734734737732739/Tambourines-to-Glory-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/9737738737731/The-Ways-of-White-Folks-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731731735735737/Simple-Takes-a-Wife-by-Langston-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731732731739/Keeper-of-the-Dream-by-Penelope-Williamson.pdfIn PDF document text
    • http://cefasfese.4pu.com/3733731732730738/The-Dream-Catcher-Arc-One-2-by-Monica-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/1738730737733730/The-Keeper-of-the-Isis-Light-Isis-1-by-Monica-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/1734735734732735/Daring-to-Dream-Holding-the-Dream-Finding-the-Dream-Dream-trilogy-1-3-by-Nora-Roberts.pdfIn PDF document text
    • http://cefasfese.4pu.com/1739732735733735/Old-English-Poems-Including-Beowulf-Battle-of-Brunanburh-Solomon-and-Saturn-Dream-of-the-Rood-Judith-Poem-Deor-Crist-Widsith-Finnesburg-Fragment-Wulf-and-Eadwacer-the-Wanderer-Poem-the-Seafarer-Poem-the-Wife-s-Lament-Rune-Poems-by-Hephaestus-Books.pdfIn PDF document text
    • http://cefasfese.4pu.com/1735738738735730/Application-for-Release-from-the-Dream-Poems-by-Tony-Hoagland.pdfIn PDF document text
    • http://cefasfese.4pu.com/1739732735734733/Plastic-Soup-Dream-Poems-by-Charles-Ghigna.pdfIn PDF document text
    • http://cefasfese.4pu.com/9734730738736/Poems-to-Dream-Together-Poemas-Para-Sonar-Juntos-by-Francisco-X-Alarc-n.pdfIn PDF document text
    • http://cefasfese.4pu.com/3737736739733733/The-Keeper-Finds-Her-Mate-Keeper-of-Wolves-2-by-Red-Phoenix.pdfIn PDF document text
    • http://cefasfese.4pu.com/2739735733730/Hashknife-Cowboy-Recollections-of-Mack-Hughes-by-Stella-Hughes.pdfIn PDF document text
    • http://cefasfese.4pu.com/7732738734736735/The-Reformed-Librarie-Keeper-Or-Two-Copies-of-Letters-Concerning-the-Place-and-Office-of-a-Librarie-Keeper-by-John-Dury.pdfIn PDF document text