Malicious PDF — malware analysis report

Static analysis result for SHA-256 408c9bb1c60d2865…

MALICIOUS

PDF

18.2 KB Created: 2019-10-31 23:52:07 +00:00 Authoring application: mPDF 5.7 First seen: 2021-06-30
MD5: 2f5602cd85458d457aa6a398ae1470f6 SHA-1: c05f338e43de9d636c488be4b3c2eff953b3de75 SHA-256: 408c9bb1c60d28652942901169c80f16373776aa537409829cf8fdb1f8795aa8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be SEO manipulation or directing users to a large collection of external content, rather than executing a direct payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730739733734736732/Doctor-Spectrum-Full-Spectrum-by-Sara-quot-Samm-quot-Barnes.pdf In PDF document text
    • http://cefasfese.4pu.com/1731739733733735735/Verzeichniss-Der-Von-Ferdinand-Freiligrath-Nachgelassenen-Bibliothek-Besonders-Reichhaltig-in-Der-Deutschen-Und-Englischen-Classischen-Literatur-Welche-Am-Dienstag-Den-18-Juni-1878-Und-an-Den-Folgenden-Tagen-Durch-Oskar-Gerschel-s-by-Ferdinand-Freiligrath.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731736737733731735/Renaissance-der-Gotik-Ferdinand-Langenberg-Neugotik-am-Niederrhein-by-Ferdinand-Langenberg.pdfIn PDF document text
    • http://cefasfese.4pu.com/2734739738735737/Fortune-Fortune-2-by-Annabel-Joseph.pdfIn PDF document text
    • http://cefasfese.4pu.com/1736739738730733/Fortune-Fortune-2-by-Annabel-Joseph.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739733734735736/Spectrum-by-M-J-Duncan.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739733734735732/Spectrum-by-Kay-Kadinger.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739733734736734/SPECTRUM-by-Draegon-Grey.pdfIn PDF document text
    • http://cefasfese.4pu.com/4734731739737731/Spectrum-by-Aidan-J-Reid.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739733734735733/Colours-in-the-Spectrum-by-Jayant-Swamy.pdfIn PDF document text
    • http://cefasfese.4pu.com/4731733735732735/The-Spectrum-Collection-by-David-Youngquist.pdfIn PDF document text
    • http://cefasfese.4pu.com/2731732738731735/Dark-End-of-the-Spectrum-by-Anthony-S-Policastro.pdfIn PDF document text
    • http://cefasfese.4pu.com/3738737730733734/Taken-by-the-Biker-Dom-The-Spectrum-Auctions-6-by-Doris-O-39-Connor.pdfIn PDF document text
    • http://cefasfese.4pu.com/2736735737733/Spectrum-2-The-Best-in-Contemporary-Fantastic-Art-by-Cathy-Fenner.pdfIn PDF document text
    • http://cefasfese.4pu.com/2736735735735/Spectrum-5-The-Best-In-Contemporary-Fantastic-Art-by-Cathy-Fenner.pdfIn PDF document text
    • http://cefasfese.4pu.com/2736735733735/Spectrum-9-The-Best-in-Contemporary-Fantastic-Art-by-Arnie-Fenner.pdfIn PDF document text
    • http://cefasfese.4pu.com/2738736738739730/See-My-Words-Spectrum-Nights-2-by-Melanie-Hansen.pdfIn PDF document text
    • http://cefasfese.4pu.com/1734737733739739/Auctioned-to-Protect-The-Spectrum-Auctions-2-by-Doris-O-39-Connor.pdfIn PDF document text
    • http://cefasfese.4pu.com/3732735737734739/Light-Weaver-Spectrum-Chronicles-1-by-Thomas-Locke.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730739733734735738/Human-Finding-myself-in-the-autism-spectrum-by-Warren-Mayocchi.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.