Malicious PDF — malware analysis report

Static analysis result for SHA-256 55eef76a1d01a39b…

MALICIOUS

PDF

14.5 KB Created: 2019-11-07 09:21:39 +00:00 Authoring application: mPDF 5.7
MD5: 98e87e89f635fceb36dcb104d13f8148 SHA-1: 8b7c633ffbe107ab0fb25598a547760e40d30a31 SHA-256: 55eef76a1d01a39bdf78edf2467613c9a1730e0724e41bd16bc5315ba4493a64
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDFs, primarily hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a redirection scheme designed to drive traffic to potentially malicious content. The ML classifier also flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2739739735736731/Expecting-His-Alpha-s-Child-Lone-Wolf-Pack-3-by-Anya-Byrne.pdf
    • http://cefasfese.4pu.com/2739739738735732/Reunited-With-His-Werewolf-Beloved-Lone-Wolf-Pack-4-2-by-Anya-Byrne.pdf
    • http://cefasfese.4pu.com/2739739735733732/A-Future-for-His-Werewolf-Warrior-Lone-Wolf-Pack-6-by-Anya-Byrne.pdf
    • http://cefasfese.4pu.com/4734735730734733/The-Lone-Alpha-Unleashed-A-Big-Girl-Meets-Bad-Wolf-Romance-by-Molly-Prince.pdf
    • http://cefasfese.4pu.com/1731734736737738731/Lone-Wolf-and-Cub-Vol-10-Hostage-Child-by-Kazuo-Koike.pdf
    • http://cefasfese.4pu.com/2739739736736736/Claimed-by-His-Hachti-Mates-Hatchi-Warriors-2-by-Anya-Byrne.pdf
    • http://cefasfese.4pu.com/4732737735736739/New-Scotia-Pack-Box-Set-Shield-Wolf-Wolf-Lover-Fire-Wolf-by-Victoria-Danann.pdf
    • http://cefasfese.4pu.com/9736731730730739/Stolen-by-the-Alpha-Wolf-Bundle-Stolen-By-the-Alpha-Wolf-1-3-by-Charlene-Hartnady.pdf
    • http://cefasfese.4pu.com/7732732734739735/Lone-Wolf-Noah-Wolf-2-by-David-Archer.pdf
    • http://cefasfese.4pu.com/1738737739739730/Alpha-Exposed-by-Anya-Breton.pdf
    • http://cefasfese.4pu.com/4738738737739734/Playing-the-Dutiful-Wife-Expecting-His-Love-Child-by-Carol-Marinelli.pdf
    • http://cefasfese.4pu.com/2733736730731732/Alpha-Flight-Classic-Vol-3-by-John-Byrne.pdf
    • http://cefasfese.4pu.com/2733736730735738/Alpha-Flight-Classic-Vol-1-by-John-Byrne.pdf
    • http://cefasfese.4pu.com/3732738736736738/The-Librarian-and-the-Wolf-Grey-Wolf-Pack-3-by-E-A-Price.pdf
    • http://cefasfese.4pu.com/8733738736737733/Lone-Wolf-by-Jodi-Picoult.pdf
    • http://cefasfese.4pu.com/4731731737737/Lone-Wolf-by-Jodi-Picoult.pdf
    • http://cefasfese.4pu.com/4733730735731730/Lone-Wolf-by-Jodi-Picoult.pdf
    • http://cefasfese.4pu.com/7732732735732734/Lone-Wolf-by-Shelley-Munro.pdf
    • http://cefasfese.4pu.com/2730739735735/Lt-Kent-Lone-Wolf-by-Judith-Lyons.pdf
    • http://cefasfese.4pu.com/3730738734736731/The-Lone-Wolf-s-Craving-by-Tina-Beckett.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.