Malicious PDF — malware analysis report

Static analysis result for SHA-256 49c186d930d6241d…

MALICIOUS

PDF

16.6 KB Created: 2019-09-27 13:30:06 +01:00 Authoring application: mPDF 5.7
MD5: 9c70c6e07a8189443b49362308e000e5 SHA-1: a93891e966f9fa8b15765323f29389e50eb41695 SHA-256: 49c186d930d6241dbcc6eb9bacc2ca9d2f5e660fb2a5b8a580f15674f3c5ed91
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs, forming a link farm. The primary heuristic indicates this is a critical finding, suggesting the document's purpose is to direct users to a multitude of external sites. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731738739739730739/Phineas-Finn-the-Irish-Member-a-Novel-by-Anthony-Trollope-in-Two-Volume-Illustrated-by-Sir-John-Everett-Millais-1st-Baronet-Pra-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/7734732739733/Mr-Scarborough-s-Family-by-Anthony-Trollope-Fiction-Literary-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4738736739739730/Marion-Fay-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/1737734731734735/The-Way-We-Live-Now-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4739738738733735/The-American-Senator-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/5733735737734/Can-You-Forgive-Her-Palliser-1-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4738735730730731/The-Vicar-of-Bullhampton-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/2734731733734730/Ayala-s-Angel-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/1736737738734735/Can-You-Forgive-Her-Volume-II-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/2733730737732731/The-Macdermots-Of-Ballycloran-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/1730735735730737731/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/1731730732737737739/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/5735731736732737/The-Lady-of-Launay-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/2736734734737730/Barchester-Towers-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/1736736739731731/Dr-Wortle-s-School-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/3732733739734735/The-Small-House-at-Allington-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4738730732735/Dr-Thorne-Chronicles-of-Barsetshire-3-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4738736734734/Phineas-Finn-Palliser-2-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4731737736730/The-Eustace-Diamonds-Palliser-3-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/7736733739730/Framley-Parsonage-Chronicles-of-Barsetshire-4-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/2733730737732731/The-Macdermots-Of-Ballycloran-by-A

Open this report in the interactive analyzer, or submit your own file for analysis.