Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d32fc208e0ffd68…

MALICIOUS

PDF

31.6 KB Created: 2019-06-10 02:44:25 +01:00 Authoring application: mPDF 5.7
MD5: b5b6c773127561012b26e3871e4f8316 SHA-1: 2226c631d6e4879a73f0f4e1dd2f41e25e2857e6 SHA-256: 5d32fc208e0ffd68c116c9bcee7fcc79be6d36ab966c351f3bdafc0ebcec62a7
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as detected by the PDF_SEO_LINK_FARM heuristic. While the ML classifier also flagged the document as malicious, the specific intent appears to be the creation of a link farm, possibly for SEO manipulation or to distribute further malicious content disguised as legitimate documents. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9670

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731736731732730736/2007-Writer-s-Market-by-Robert-Lee-Brewer.pdf
    • http://cefasfese.4pu.com/1731738738736730735/2007-Report-on-Pin-Tumbler-Padlocks-The-World-Market-Segmentation-by-City-by-Philip-M-Parker.pdf
    • http://cefasfese.4pu.com/1731732736739736735/2007-5th-International-Conference-on-Microwave-and-Millimeter-Wave-Technology-Proceedings-Icmmt-2007-April-19-21-2007-Guilin-China-by-Institute-of-Electrical-and-Electronics-Engineers.pdf
    • http://cefasfese.4pu.com/7737737734739734/2007-Report-on-Barytes-Blanc-Fixe-Whiting-Ceramic-Color-and-Other-White-Extender-Pigments-The-World-Market-Segmentation-by-City-by-Philip-M-Parker.pdf
    • http://cefasfese.4pu.com/8730731731734732/CONCUR-2007---Concurrency-Theory-18th-International-Conference-CONCUR-2007-Lisbon-Portugal-September-3-8-2007-Proceedings-by-Luis-Caires.pdf
    • http://cefasfese.4pu.com/1738738734737/Design-of-Experiments-for-Process-Improvement-and-Quality-Assurance-by-Robert-F-Brewer.pdf
    • http://cefasfese.4pu.com/1731736731731736737/Best-Music-Writing-2007-by-Robert-Christgau.pdf
    • http://cefasfese.4pu.com/1730730733732730732/Combinatorial-Number-Theory-Proceedings-of-the-Integers-Conference-2007-Carrollton-Georgia-USA-October-24--27-2007-by-Bruce-Landman.pdf
    • http://cefasfese.4pu.com/7736731734731737/B-2007-Formal-Specification-and-Development-in-B-7th-International-Conference-of-B-Users-Besancon-France-January-7-19-2007-Proceedings-by-Jacques-Julliand.pdf
    • http://cefasfese.4pu.com/2730738734737738/The-Ghost-Writer-by-Robert-Harris.pdf
    • http://cefasfese.4pu.com/1730739730739738732/The-New-Governance-and-Implementation-of-Labour-Market-Policies-by-Robert-Arnkil.pdf
    • http://cefasfese.4pu.com/4730734732732732/Chaos-Theory-Two-Essays-on-Market-Anarchy-by-Robert-P-Murphy.pdf
    • http://cefasfese.4pu.com/1731732739739733732/Advanced-Environmental-Chemical-And-Biological-Sensing-Technologies-V-10-11-September-2007-Boston-Massachusetts-Usa-by-Robert-A-Lieberman.pdf
    • http://cefasfese.4pu.com/9738737736737/Killing-the-Market-Legendary-Investor-Robert-W-Wilson-by-Roemer-McPhee.pdf
    • http://cefasfese.4pu.com/8733731730730731/SharePoint-2007-MVP-14-Indispensable-Lessons-from-the-SharePoint-Experts-by-Robert-L-Bogue.pdf
    • http://cefasfese.4pu.com/7737733736731730/Rich-Dad-s-Prophecy-Why-the-Biggest-Stock-Market-Crash-in-History-Is-Still-Coming-and-How-You-Can-Prepare-Yourself-and-Profit-from-It-by-Robert-T-Kiyosaki.pdf
    • http://cefasfese.4pu.com/5734733731733735/Tactical-Management-in-the-Secular-Bear-Market-How-Tactical-Management-and-Market-Phases-Can-Help-Manage-Risk-and-Make-Money-in-the-Secular-Bear-Market-by-Tahar-Mjigal.pdf
    • http://cefasfese.4pu.com/1730732737738731736/A-Writer-s-Guide-to-Creative-Blogging-Create-the-Writer-s-Blog-You-ve-Always-Wanted-by-Paul-Nieder.pdf
    • http://cefasfese.4pu.com/9736730737733732/Algebraic-Biology-Second-International-Conference-Ab-2007-Castle-Of-Hagenberg-Austria-July-2-4-2007-Proceedings-Lecture-Notes-In-Computer-Science-Computer-Science-And-General-Issues-by-Hirokazu-Anai.pdf
    • http://cefasfese.4pu.com/2737735737738739/Writer-to-Writer-From-Think-to-Ink-by-Gail-Carson-Levine.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.