Malicious PDF — malware analysis report

Static analysis result for SHA-256 44bd7171b4662602…

MALICIOUS

PDF

28.2 KB Created: 2019-06-05 05:30:35 +01:00 Authoring application: mPDF 5.7
MD5: 017735fb2b452633aa131c59b0728b21 SHA-1: f363caa1b3158a399bd870b0866de571c588a3cb SHA-256: 44bd7171b4662602df3c4e9da1cc4485d2b8b4aa580c0230521a68a67e42c38e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with 30 links detected. The primary heuristic, PDF_SEO_LINK_FARM, indicates a high likelihood of malicious intent, likely to redirect users to phishing or malware sites. The ML classifier also flagged this PDF with a high score. The document body was unreadable, but the presence of numerous links from the host 'cefasfese.4pu.com' strongly suggests a malicious lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9742

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/7731736734734739/Heimlich-geliebt-Zwei-Seiten-einer-Medaille-by-Karin-Kaiser.pdf
    • http://cefasfese.4pu.com/7731736734739734/Die-Kehrseite-der-Medaille-Ricardos-Wege-Zwei-Geschichten-in-einem-Buch-by-Marc-Schuhmacher.pdf
    • http://cefasfese.4pu.com/1730731735736733738/Frauenfedern-morden-sanfter-Band-2---Zwei-Kriminalromane-by-Karin-Welters.pdf
    • http://cefasfese.4pu.com/1731733733735735736/Spracheinstellungen-Von-Grundschuelerinnen-Und-Grundschuelern-in-Einer-Grenzregion-Qualitative-Untersuchung-in-Zwei-Paritaetisch-Unterrichteten-Ersten-Klassen-Mit-Zielsprache-Franzoesisch-by-Julia-Putsche.pdf
    • http://cefasfese.4pu.com/1730734738736732736/Die-Klosterruine-in-Norwegen-Nach-Einer-Norwegischen-Criminellen-Begebenheit-Das-Judasbild-Zwei-Erzahlungen-Von-L-Kruse-by-Laurids-Kruse.pdf
    • http://cefasfese.4pu.com/9735738732735730/Die-Zweiflerin-Erlebnisse-einer-Reiki-Meisterin-und-Reiki-Lehrerin-in-Mecklenburg-Vorpommern-by-Karin-Hinse.pdf
    • http://cefasfese.4pu.com/1731730735738739733/Verf-hrung-auf-den-ersten-Blick-K-sse-in-einer-Fr-hlingsnacht-Sag-zum-Abschied-quot-Ich-liebe-dich-quot-Zwei-wie-Feuer-und-Wasser-by-Emma-Darcy.pdf
    • http://cefasfese.4pu.com/1731733733735736735/Das-Suedamerikabild-ALS-Personenbezogenes-Europaeisches-Und-Interkontinentales-Phaenomen-Imagologische-Untersuchung-Zu-Graf-Hermann-Keyserlings-Suedamerikanischen-Meditationen-Mit-Einer-Zusammenfassung-in-Englisch-Franzoesisch-Und-Spanisch-by-Karin-Schmidt.pdf
    • http://cefasfese.4pu.com/9739735734736738/Uber-Die-Astigmatische-Abbildung-Einer-Unbegrenzten-Ebene-in-Einer-Kugel-Bezuglich-Eines-Festen-Augenpunktes-Inaugural-Dissertation-Zur-Erlangung-Der-Doktorwurde-Einer-Hohen-Philosophischen-Fakultat-Der-Universitat-Rostock-by-Johannes-Bieneck.pdf
    • http://cefasfese.4pu.com/9733733730731739/Out-of-Step-by-Jane-Heimlich.pdf
    • http://cefasfese.4pu.com/8737738733731731/Hei-geliebt---Eiskalt-gemordet-by-Sylvia-Filz.pdf
    • http://cefasfese.4pu.com/9733733730731733/Heimlich-the-Donut-by-William-Merricle.pdf
    • http://cefasfese.4pu.com/9733733730731732/Heimlich-s-Manoeuvre-by-Paula-Cunningham.pdf
    • http://cefasfese.4pu.com/9737730731736735/Sanft-ber-hrte-Narben-Unsterblich-geliebt-3-by-Lara-Greystone.pdf
    • http://cefasfese.4pu.com/1731735738736734733/Heimlich-Fee-8-Wie-wir-dem-Elfenreich-zu-Hilfe-eilten-by-Thilo.pdf
    • http://cefasfese.4pu.com/1730736737733733731/Du-wirst-geliebt---Eine-Liebeserkl-rung-deiner-Seele-by-Gaby-Shayana-Hoffmann.pdf
    • http://cefasfese.4pu.com/1731735738737737737/Heimlich-Fee-4-Wie-ein-Zauber-alles-auf-den-Kopf-stellte-by-Thilo.pdf
    • http://cefasfese.4pu.com/1731735738735730738/Heimlich-Fee-1-Wie-eine-Freundin-in-mein-Leben-purzelte-by-Thilo.pdf
    • http://cefasfese.4pu.com/7731736733738738/Meditations-on-the-Gospels-For-Every-Day-in-the-Year-by-Pere-Medaille.pdf
    • http://cefasfese.4pu.com/7731736733738734/Le-vieux-n-gre-et-la-m-daille-by-Ferdinand-Oyono.pdf
    • http://cefasfese.4pu.com/1730734738736732736/Die-Klosterruine-in-Norwegen-Nach-Einer-Norwegischen-Criminellen-Begebenheit-Das-Judasbild-Zwei-

Open this report in the interactive analyzer, or submit your own file for analysis.