Malicious PDF — malware analysis report

Static analysis result for SHA-256 63beb0c0888c947e…

MALICIOUS

PDF

16.3 KB Created: 2019-05-27 13:23:58 +01:00 Authoring application: mPDF 5.7
MD5: 8ddf8b8e6d9e1b4adb6d357f3228b1da SHA-1: 76d64f64216f2771ab961ea4bd6d795067a4bdf3 SHA-256: 63beb0c0888c947eddc4372a2d5ea96122b15e13f83b86c5456a2f7fe3ad570e
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links, identified by the 'PDF_SEO_LINK_FARM' heuristic, which are presented as book titles. While many of these URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to redirect users to potentially harmful content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4732730731737735/Saving-Mike-The-McGregor-Chronicles-1-by-Larry-K-Collins.pdf
    • http://cefasfese.4pu.com/4730739730732732/Saving-Private-Ryan-by-Max-Allan-Collins.pdf
    • http://cefasfese.4pu.com/6734734730737730/The-Fifth-Horseman-by-Larry-Collins.pdf
    • http://cefasfese.4pu.com/4739735734730731/Saving-the-Stallion-Stetson-Series-3-by-Candy-Collins.pdf
    • http://cefasfese.4pu.com/2734738734733737/Saving-Paradise-by-Mike-Bond.pdf
    • http://cefasfese.4pu.com/9732731737730/Freedom-at-Midnight-by-Larry-Collins.pdf
    • http://cefasfese.4pu.com/1731735738735730/The-Memory-Keeper-by-Larry-K-Collins.pdf
    • http://cefasfese.4pu.com/7735733738731738/Bride-Of-Frankenstein-Vow-Of-Vengence-by-Larry-Mike-Garmon.pdf
    • http://cefasfese.4pu.com/3733733731735733/Tokyo-Raider-A-Tale-of-the-Grimnoir-Chronicles-Grimnoir-Chronicles-3-6-by-Larry-Correia.pdf
    • http://cefasfese.4pu.com/8735732739738/Saving-Raphael-Santiago-The-Bane-Chronicles-6-by-Cassandra-Clare.pdf
    • http://cefasfese.4pu.com/2739730739739735/Warbound-Grimnoir-Chronicles-3-by-Larry-Correia.pdf
    • http://cefasfese.4pu.com/2733733730738733/Warbound-Grimnoir-Chronicles-3-by-Larry-Correia.pdf
    • http://cefasfese.4pu.com/4731735730738735/The-Razing-of-the-Id-The-Chrietzberg-Chronicles-by-Larry-M-Binion.pdf
    • http://cefasfese.4pu.com/4731731733732/Hard-Magic-Grimnoir-Chronicles-1-by-Larry-Correia.pdf
    • http://cefasfese.4pu.com/1730731736736732/Gregor-the-Overlander-Box-Set-Underland-Chronicles-1-5-by-Suzanne-Collins.pdf
    • http://cefasfese.4pu.com/1737738730736731/Gregor-the-Overlander-Underland-Chronicles-1-by-Suzanne-Collins.pdf
    • http://cefasfese.4pu.com/5730731733737735/A-Woman-of-Influence-The-Pemberley-Chronicles-9-by-Rebecca-Ann-Collins.pdf
    • http://cefasfese.4pu.com/9735732732735/From-the-Ashes-The-Myatheira-Chronicles-The-Vor-shai-1-by-Melissa-Collins.pdf
    • http://cefasfese.4pu.com/4730737736738738/Gregor-the-Overlander-Underland-Chronicles-1-by-Suzanne-Collins.pdf
    • http://cefasfese.4pu.com/5730732735734734/The-Chronicles-of-Lucifer-Jones-Volume-I----1922-1926-Adventures-The-Chronicles-of-Lucifer-Jones-1-by-Mike-Resnick.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.