Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a92c9e52f1d79fa…

MALICIOUS

PDF

17.7 KB Created: 2019-11-09 23:58:23 +00:00 Authoring application: mPDF 5.7
MD5: 4b9a4d72790e2d0256febcc176a0fdd9 SHA-1: 3f6e1b98fd88ea3ff584875d4336659604e7eb79 SHA-256: 5a92c9e52f1d79fa0328db9dc292c2ef8dee8b83315957411c9f55f31e8c3275
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, many of which are structured as numeric slugs, indicating a potential SEO link farm. The ML classifier also flagged this PDF as malicious. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly to manipulate search engine rankings or to serve as a distribution point for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4734730735733736/-oku-The-Inner-Chambers-Volume-5-oku-The-Inner-Chambers-5-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/1730735738730739/-oku-The-Inner-Chambers-Volume-1-oku-The-Inner-Chambers-1-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/4734730735733735/-oku-The-Inner-Chambers-Volume-4-oku-The-Inner-Chambers-4-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/2738734731730730/Fumi-Yoshinaga-s-Lovers-in-the-Night-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/1730735739730737730/What-Did-You-Eat-Yesterday-Volume-2-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/1730735739730737738/What-Did-You-Eat-Yesterday-Volume-3-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/2738733739731736/Ichigenme-The-First-Class-Is-Civil-Law-Volume-1-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/1731737730730738731/Chambers-Crossword-Lists---New-Edition-by-Chambers-Dictionaries.pdf
    • http://cefasfese.4pu.com/1730735734731739735/Chambers-s-Edinburgh-Journal-No-455-by-Robert-Chambers.pdf
    • http://cefasfese.4pu.com/1731738731738731732/Chambers-s-Edinburgh-Journal-No-458-by-Robert-Chambers.pdf
    • http://cefasfese.4pu.com/1730735739730738734/Don-t-Say-Anymore-Darling-by-Fumi-Yoshinaga.pdf
    • http://cefasfese.4pu.com/1730735734733739732/Chambers-s-Edinburgh-Journal-No-455-Volume-18-New-Series-September-18-1852-by-Various.pdf
    • http://cefasfese.4pu.com/1731738732730734739/Chambers-s-Edinburgh-Journal-No-458-Volume-18-New-Series-October-9-1852-by-Various.pdf
    • http://cefasfese.4pu.com/1739732734734738/Only-with-You-Only-Colorado-1-by-J-D-Chambers.pdf
    • http://cefasfese.4pu.com/3738737733737736/The-Pineville-Heist-by-Lee-Chambers.pdf
    • http://cefasfese.4pu.com/8735739735737733/Police-by-Robert-W-Chambers.pdf
    • http://cefasfese.4pu.com/4737732732733736/The-Thirteenth-Torment-by-Pam-Chambers.pdf
    • http://cefasfese.4pu.com/4731733738738737/Comfort-and-Joy-by-Joanna-Chambers.pdf
    • http://cefasfese.4pu.com/7730730735737/The-Betrayer-by-Kimberley-Chambers.pdf
    • http://cefasfese.4pu.com/3735738735737733/The-Wronged-by-Kimberley-Chambers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.