Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fb6c576f6656d38…

MALICIOUS

PDF

15.7 KB Created: 2019-11-07 08:02:26 +00:00 Authoring application: mPDF 5.7
MD5: 47b8e46a449887f3660e9ef617cd0620 SHA-1: e600ce683ef159904651e4b1b626172931820bb2 SHA-256: 5fb6c576f6656d388d1902f9f8823d19692eb8b37436b4fd776786672d846d11
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm. While the document body is unreadable, the heuristic 'PDF_SEO_LINK_FARM' indicates the primary purpose is to host external links. The ML classifier also flagged the PDF as malicious. No scripts were extracted, but the presence of numerous links suggests a potential for distributing further malicious content or for SEO abuse.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2737738734735730/The-Riveauxs-Wolves-of-the-Rising-Sun-Vol-1-Box-Set-Wolves-of-the-Rising-Sun-1-3-Mating-Season-by-Kenzie-Cox.pdf
    • http://cefasfese.4pu.com/6738738732736730/Aiden-Wolves-of-the-Rising-Sun-2-by-Kenzie-Cox.pdf
    • http://cefasfese.4pu.com/2739739738735737/Not-to-Be-Messed-With-Mating-with-Wolves-2-by-Marcy-Jacks.pdf
    • http://cefasfese.4pu.com/4738730735738738/A-Cougar-Among-Wolves-Black-Hills-Wolves-45-by-Kali-Willows.pdf
    • http://cefasfese.4pu.com/4736732731739739/The-Wolves-of-Willoughby-Chase-The-Wolves-Chronicles-1-by-Joan-Aiken.pdf
    • http://cefasfese.4pu.com/2733736734738736/The-Wolves-of-Willoughby-Chase-The-Wolves-Chronicles-1-by-Joan-Aiken.pdf
    • http://cefasfese.4pu.com/2737737737739736/Dances-with-Wolves-Highland-Wolves-1-by-Mandy-Monroe.pdf
    • http://cefasfese.4pu.com/4734736732731736/Red-Season-Rising-Red-Season-1-by-D-M-Murray.pdf
    • http://cefasfese.4pu.com/3736731732739734/The-Rising-Selected-Scenes-from-the-End-of-the-World-The-Rising-3-by-Brian-Keene.pdf
    • http://cefasfese.4pu.com/3734734738737734/Among-Wolves-Wolves-of-Llis-1-by-Nancy-K-Wallace.pdf
    • http://cefasfese.4pu.com/6738732734738/The-Song-Rising-The-Bone-Season-3-by-Samantha-Shannon.pdf
    • http://cefasfese.4pu.com/6736732737735734/Red-Rising-Red-Rising-Trilogy-1-by-Pierce-Brown.pdf
    • http://cefasfese.4pu.com/2738731731731739/Red-Rising-Red-Rising-Trilogy-1-by-Pierce-Brown.pdf
    • http://cefasfese.4pu.com/2733738736736/Buffy-the-Vampire-Slayer-Wolves-at-the-Gate-Season-8-Volume-3-by-Drew-Goddard.pdf
    • http://cefasfese.4pu.com/1735736739739730/Rys-Rising-Rys-Rising-1-by-Tracy-Falbe.pdf
    • http://cefasfese.4pu.com/4739732739731739/Red-Rising-Red-Rising-1-by-Pierce-Brown.pdf
    • http://cefasfese.4pu.com/3739732732730/Red-Rising-Red-Rising-1-by-Pierce-Brown.pdf
    • http://cefasfese.4pu.com/2731733736733737/Rising-Rising-1-by-Holly-Kelly.pdf
    • http://cefasfese.4pu.com/2735737731738/Raised-by-Wolves-Raised-by-Wolves-1-by-Jennifer-Lynn-Barnes.pdf
    • http://cefasfese.4pu.com/2738734734730730/Raised-by-Wolves-Raised-by-Wolves-1-by-Jennifer-Lynn-Barnes.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.