Malicious PDF — malware analysis report

Static analysis result for SHA-256 5121b3aaec42177c…

MALICIOUS

PDF

20.8 KB Created: 2019-05-02 05:07:43 +01:00 Authoring application: mPDF 5.7 First seen: 2021-10-23
MD5: c09c1e11c372b8cca72534a2e33c0b09 SHA-1: 62ceb7a5ff63ba18622f2e4628e54cf042709c0d SHA-256: 5121b3aaec42177c981a82d5c8f8fe5c81955f71328b23d9ede85185f7e22027
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, identified as a link farm. While the URLs themselves are currently classified as benign, the sheer volume and the heuristic firing of 'PDF_SEO_LINK_FARM' suggest a malicious intent, possibly for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9924

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731736739737737736/Fish---Noch-mehr-Fish---F-r-immer-Fish-Dreimal-ungew-hnliche-Motivation-in-einem-Band-by-Stephen-C-Lundin.pdf In PDF document text
    • http://cefasfese.4pu.com/5738739730732736/Un-poisson-deux-poissons-un-poisson-rouge-un-poisson-bleu-One-Fish-Two-Fish-Red-Fish-Blue-Fish-by-Dr-Seuss.pdfIn PDF document text
    • http://cefasfese.4pu.com/8736732735737736/One-Fish-Two-Fish-Red-Fish-Blue-Fish-by-Dr-Seuss.pdfIn PDF document text
    • http://cefasfese.4pu.com/7734733737733732/One-Fish-Two-Fish-Red-Fish-Blue-Fish-by-Dr-Seuss.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734737736730730/One-Fish-Two-Fish-Red-Fish-Blue-Fish-by-Dr-Seuss.pdfIn PDF document text
    • http://cefasfese.4pu.com/4737732737737731/A-Few-Good-Fish-Fish-Out-of-Water-3-by-Amy-Lane.pdfIn PDF document text
    • http://cefasfese.4pu.com/3739733739736736/A-Cat-Named-Mouse-A-Cat-Named-Mouse-5-by-Nick-James.pdfIn PDF document text
    • http://cefasfese.4pu.com/2736731735732736/The-Boyfriend-List-15-Guys-11-Shrink-Appointments-4-Ceramic-Frogs-and-Me-Ruby-Oliver-Ruby-Oliver-1-by-E-Lockhart.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734737737737730/The-Treasure-Map-of-Boys-Noel-Jackson-Finn-Hutch-Gideon-and-me-Ruby-Oliver-Ruby-Oliver-3-by-E-Lockhart.pdfIn PDF document text
    • http://cefasfese.4pu.com/4730734731730/The-Boyfriend-List-15-Guys-11-Shrink-Appointments-4-Ceramic-Frogs-and-Me-Ruby-Oliver-Ruby-Oliver-1-by-E-Lockhart.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731735737730738737/Oliver-Sacks-24-Brilliant-Teachings-And-Lessons-From-Oliver-Sacks-by-Joseph-Fisher.pdfIn PDF document text
    • http://cefasfese.4pu.com/3738739730731739/Saving-Miss-Oliver-s-Miss-Oliver-s-School-for-Girls-1-by-Stephen-Davenport.pdfIn PDF document text
    • http://cefasfese.4pu.com/2738737733733/Oliver-Booth-and-the-Evil-Socialite-Oliver-Booth-2-by-David-Desmond.pdfIn PDF document text
    • http://cefasfese.4pu.com/2730739731737736/The-Japanese-Devil-Fish-Girl-and-Other-Unnatural-Attractions-Japanese-Devil-Fish-Girl-1-by-Robert-Rankin.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731730734732734739/Remembering-Oliver-Strunk-Teacher-and-Scholar-by-W-Oliver-Strunk.pdfIn PDF document text
    • http://cefasfese.4pu.com/1731739734737735730/Pout-Pout-Pack-The-Pout-Pout-Fish-and-The-Pout-Pout-Fish-in-the-Big-Big-Dark-by-Deborah-Diesen.pdfIn PDF document text
    • http://cefasfese.4pu.com/3739734738736/Someone-Named-Eva-by-Joan-M-Wolf.pdfIn PDF document text
    • http://cefasfese.4pu.com/3731737733735734/A-Cat-Named-Squeeky-by-Vic-Reskovic.pdfIn PDF document text
    • http://cefasfese.4pu.com/1736731733730734/A-Cat-Named-Hercules-by-K-C-Kendricks.pdfIn PDF document text
    • http://cefasfese.4pu.com/1736734736732737/Named-of-the-Dragon-by-Susanna-Kearsley.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.