Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ef383bf50a2fe72…

MALICIOUS

PDF

16.0 KB Created: 2019-05-02 02:10:26 +01:00 Authoring application: mPDF 5.7
MD5: 0c6d4c5e57a76e9f4a0711949cc6e2f7 SHA-1: d1fcac1578c4a0e432aece243768aaa64378ee0b SHA-256: 3ef383bf50a2fe72a9482335fce4f6a6e2cf3ed9feddfb55bfb78b3ccfd02c98
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF documents hosted on the domain 'cefasfese.4pu.com'. This pattern is indicative of a link farm designed to drive traffic or potentially host malicious content, although the specific URLs extracted were flagged as benign. The ML classifier strongly indicated maliciousness, suggesting a more sophisticated or novel threat. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2735734733730733/The-City-in-the-Sahara-Book-2-of-the-Barsac-Mission-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/5738738731730739/Twenty-Thousand-Leagues-Under-The-Sea-By-Jules-Verne---Illustrated-And-Unabridged-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/1730738733738735739/A-Floating-City-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/4739738739739730/A-Floating-City-Extraordinary-Voyages-8-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/6738737739736731/Jules-Verne-3-uvres-majeurs-illustr-es-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/5739738734733736/Mathias-Sandorf-by-Jules-Verne-Book-1-by-Edward-Brumgnach.pdf
    • http://cefasfese.4pu.com/5734738732733737/The-Works-of-Jules-Verne-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/1730738733738734737/Dick-Sands-Or-The-Boy-Captain-Original-Hetzel-Illustrations-A-Captain-at-Fifteen-Voyages-Extraordinaire-Book-17-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/3730732732731732/The-Field-of-Ice-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/7737736732738730/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/6739738736731734/L-le-myst-rieuse-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/3737731734736731/20-000-Leagues-Under-the-Sea-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/6732735735734735/Magellania-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/7736732736731735/Around-the-World-in-80-Days-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/1735739738739731/Five-Weeks-in-a-Balloon-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/8738735737732/Around-The-World-In-80-Days-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/1730734731738739738/20-000-Leagues-Under-the-Sea-Includes-eBook-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/8732737738737730/Scheherazade-s-Last-Night-and-Other-Plays-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/6730736731737732/Il-giro-del-mondo-in-80-giorni-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/7737730732731735/Will-Of-An-Eccentric-Extraordinary-Voyages-46-by-Jules-Verne.pdf
    • http://cefasfese.4pu.com/7737736732738730/20-000-Leagues-Under-the-Sea-by-J

Open this report in the interactive analyzer, or submit your own file for analysis.