Malicious PDF — malware analysis report

Static analysis result for SHA-256 69717c72ffe13fc9…

MALICIOUS

PDF

16.7 KB Created: 2019-05-02 06:10:28 +01:00 Authoring application: mPDF 5.7
MD5: 74e18bfa5d9d8cd87450dfc6d71e969d SHA-1: ef1b5274e2f9fa6bcb717b1b3c299fcc8ed209b9 SHA-256: 69717c72ffe13fc925bc833ccbbe841082f3557a7125d01d0cd3988bf0ca7965
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or phishing attempt. While the document body is heavily obfuscated, the presence of numerous external links points to a malicious intent to redirect users to potentially harmful websites. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9787

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1735731732730739/Blue-Bells-of-Scotland-Blue-Bells-Trilogy-1-by-Laura-Vosika.pdf
    • http://cefasfese.4pu.com/1738733734735736/The-Predicteds-by-Christine-Seifert.pdf
    • http://cefasfese.4pu.com/1730731732732737732/Lehrbuch-Der-Topologie-by-Herbert-Seifert.pdf
    • http://cefasfese.4pu.com/4734733739735731/Witch-Doctor-Vol-1-Under-the-Knife-by-Brandon-Seifert.pdf
    • http://cefasfese.4pu.com/1730739735730737732/Collaborative-Planning-Forecasting-And-Replenishment-Supply-Chain-Managementder-N-chsten-Generation-by-Dirk-Seifert.pdf
    • http://cefasfese.4pu.com/1731734734735739739/Witchcraft-and-Medicine-by-Jaroslav-Nemec.pdf
    • http://cefasfese.4pu.com/1731730734730739735/Jaroslav-Rossler-by-Vladim-r-Birgus.pdf
    • http://cefasfese.4pu.com/9734739731734736/Bach-Among-the-Theologians-by-Jaroslav-Pelikan.pdf
    • http://cefasfese.4pu.com/3735730738735/The-Good-Soldier-vejk-by-Jaroslav-Ha-ek.pdf
    • http://cefasfese.4pu.com/1731732731739733735/The-Good-Soldier-Schweik-by-Jaroslav-Ha-ek.pdf
    • http://cefasfese.4pu.com/8733735737737739/Almanhy-Antonlna-Jaroslava-Puchmajera-by-Jaroslav-Vlek.pdf
    • http://cefasfese.4pu.com/4735737738734737/Casting-Shadows-Everywhere-by-L-T-Vargus.pdf
    • http://cefasfese.4pu.com/3738735732736736/Casting-Stones-by-G-M-Barlean.pdf
    • http://cefasfese.4pu.com/4735738738739731/The-Casting-by-Joyce-Shor-Johnson.pdf
    • http://cefasfese.4pu.com/1733737733735731/The-Fateful-Adventures-of-the-Good-Soldier-vejk-During-the-World-War-Book-One-by-Jaroslav-Ha-ek.pdf
    • http://cefasfese.4pu.com/3736737731732734/The-Fateful-Adventures-of-the-Good-Soldier-Svejk-During-the-World-War-Book-Two-by-Jaroslav-Ha-ek.pdf
    • http://cefasfese.4pu.com/3738738730738732/Casting-the-Runes-and-Other-Ghost-Stories-by-M-R-James.pdf
    • http://cefasfese.4pu.com/5739732737730/Casting-the-Runes-and-Other-Ghost-Stories-by-M-R-James.pdf
    • http://cefasfese.4pu.com/6735737731732730/Principles-of-Metal-Casting-by-Mahi-Sahoo.pdf
    • http://cefasfese.4pu.com/8738736737738731/Materials-Processing-During-Casting-by-Hasse-Fredriksson.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.