Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e952fa9deab2971…

MALICIOUS

PDF

17.4 KB Created: 2019-05-03 05:52:16 +01:00 Authoring application: mPDF 5.7
MD5: b10e56600abe9691169a82317690e07e SHA-1: 90dee22cb92f246497609356d3678e763c0f76d0 SHA-256: 4e952fa9deab2971fa1f8fea04e9f346193b3662d185084055b966c0eeedc29e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious, supporting the assessment of a malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9789

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731738739737739737/Jack-amp-Susan-in-1913-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1739734735737730/The-War-Blackwater-4-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1732737738735736/The-Amulet-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1736734732735737/Alternities-by-Michael-P-Kube-McDowell.pdf
    • http://cefasfese.4pu.com/1739734735736733/The-Levee-Blackwater-2-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/3734733734730732/Gilded-Needles-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1739734735736734/The-House-Blackwater-3-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1739734735736731/The-Flood-Blackwater-1-by-Michael-McDowell.pdf
    • http://cefasfese.4pu.com/1736733730736738/Enigma-The-Trigon-Disunity-2-by-Michael-P-Kube-McDowell.pdf
    • http://cefasfese.4pu.com/1736732738730735/Emprise-The-Trigon-Disunity-1-by-Michael-P-Kube-McDowell.pdf
    • http://cefasfese.4pu.com/1731738733739730731/November-s-Fury-The-Deadly-Great-Lakes-Hurricane-of-1913-by-Michael-Schumacher.pdf
    • http://cefasfese.4pu.com/1730733732732733734/Proceedings-of-the-Court-for-the-Trial-of-Impeachments-the-People-of-the-State-of-New-York-by-the-Assembly-Thereof-Against-William-Sulzer-as-Governor-Held-at-the-Capital-in-the-City-of-Albany-New-York-September-18-1913-to-October-17-1913-by-William-Sulzer.pdf
    • http://cefasfese.4pu.com/3735738734734730/JACK-just-an-ordinary-dog-in-the-dog-house-by-Susan-Tarr.pdf
    • http://cefasfese.4pu.com/6733738736731739/Jack-Kerouac-A-Biography-by-Michael-J-Dittman.pdf
    • http://cefasfese.4pu.com/8732735734736739/The-Wharf-Butcher-DCI-Jack-Mason-1-by-Michael-K-Foster.pdf
    • http://cefasfese.4pu.com/4733736733737734/The-Nestorian-Alliance-A-Jack-Trader-Adventure-by-Michael-R-Watson.pdf
    • http://cefasfese.4pu.com/1731738739733736/The-Somnambulist-by-Zan-Mcdowell.pdf
    • http://cefasfese.4pu.com/1733735738736/Jack-on-the-Tracks-Four-Seasons-of-Fifth-Grade-Jack-Henry-4-by-Jack-Gantos.pdf
    • http://cefasfese.4pu.com/2733736733737736/Just-For-Clicks-by-Kara-McDowell.pdf
    • http://cefasfese.4pu.com/9734739732737731/Ospreys-in-Danger-by-Pamela-McDowell.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.