Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e96e50c655d251f…

MALICIOUS

PDF

23.4 KB Created: 2019-05-02 17:49:09 +01:00 Authoring application: mPDF 5.7
MD5: bc5f3b5ce1563ea8e929179944aebd4e SHA-1: 48605becc437f0b742228d4250cfbd916e14dc77 SHA-256: 4e96e50c655d251f4b1f0be96dc5f538b8860e0c5f1063d4eff58169b179b49d
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified as a link farm, pointing to external PDF documents. This behavior is indicative of SEO poisoning or a similar tactic to drive traffic to specific content. The ML classifier also flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9784

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730732731735731734/The-Habsburg-Monarchy-1809-1918-by-A-J-P-Taylor.pdf
    • http://cefasfese.4pu.com/1731736737737737738/The-Austro-Hungarian-Dual-Monarchy-1867-1918-by-Zsuzsa-Gaspar.pdf
    • http://cefasfese.4pu.com/5731733733735739/From-Renaissance-Monarchy-to-Absolute-Monarchy-French-Kings-Nobles-and-Estates-by-J-Russell-Major.pdf
    • http://cefasfese.4pu.com/8738730733731734/The-Habsburg-Caf-by-Andrew-Riemer.pdf
    • http://cefasfese.4pu.com/8738730733730732/The-Habsburg-Cafe-by-Andrew-Riemer.pdf
    • http://cefasfese.4pu.com/1730732738731737735/Truber-Ungnad-amp-Vergerio-Territorial-Churches-in-the-Habsburg-Ottoman-Borderlands-by-Benjamin-Esswein.pdf
    • http://cefasfese.4pu.com/7739732738736735/Richelieu-and-the-French-Monarchy-by-C-V-Wedgwood.pdf
    • http://cefasfese.4pu.com/1733739733738732/The-Enchanted-Glass-Britain-and-its-Monarchy-by-Tom-Nairn.pdf
    • http://cefasfese.4pu.com/1731730736736734738/Hawaii-From-Origins-To-The-End-Of-The-Monarchy-by-Brien-Foerster.pdf
    • http://cefasfese.4pu.com/2738732738733/Monarchy-in-the-Emperor-s-Eyes-by-Harold-L-Kahn.pdf
    • http://cefasfese.4pu.com/4739734731735735/Good-Enough-for-a-Princess-The-Montevaro-Monarchy-1-by-Carol-Moncado.pdf
    • http://cefasfese.4pu.com/1730738739738732733/Hellenistic-Egypt-Monarchy-Society-Economy-Culture-by-Jean-Bingen.pdf
    • http://cefasfese.4pu.com/9730735738738739/James-Bond-in-60-Minuten-Staunen-im-Stundentakt---Die-Welt-in-60-Minuten-by-Eduard-Habsburg.pdf
    • http://cefasfese.4pu.com/2733738734739739/The-Royal-Touch-Sacred-Monarchy-And-Scrofula-In-England-And-France-by-Marc-Bloch.pdf
    • http://cefasfese.4pu.com/4730739732738730/The-Feudal-Monarchy-in-France-and-England-from-the-Tenth-to-the-Thirteenth-Century-by-Charles-Petit-Dutaillis.pdf
    • http://cefasfese.4pu.com/5730736739739731/Napoleonic-Imperialism-and-the-Savoyard-Monarchy-1773-1821-State-Building-in-Piedmont-by-Michael-Broers.pdf
    • http://cefasfese.4pu.com/3736735736730734/Spiritual-Secret-of-Hudson-Taylor-by-Howard-Taylor.pdf
    • http://cefasfese.4pu.com/7730739738732738/The-Whole-Works-of-the-Right-Rev-Jeremy-Taylor-Worthy-Communicant-Supplement-of-Sermons-Collection-of-Offices-by-Jeremy-Taylor.pdf
    • http://cefasfese.4pu.com/5735736731734733/Veuve-Taylor-by-Henrietta-Taylor.pdf
    • http://cefasfese.4pu.com/9731738734733733/Der-Habsburgmythos-und-seine-Darstellung-in-Joseph-Roths-quot-Radetzkymarsch-quot-Rather-than-merely-glorifying-the-Habsburg-myth-Roth-s-quot-Radetzkymarsch-quot-shows-at-which-it-was-upheld-by-Robert-Fellner.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.