Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ec4cfba6cfe6deb…

MALICIOUS

PDF

16.7 KB Created: 2019-08-02 07:36:19 +01:00 Authoring application: mPDF 5.7 First seen: 2021-10-16
MD5: a94c16287257f9f330f14ae55c3b5395 SHA-1: d6d1c22084bd9977e242a76a31b7bdc7968c0795 SHA-256: 6ec4cfba6cfe6deb150e53670c9504e1c581f655d1ca643613b39294b1c46e27
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified as a link farm. While the content of the document body is heavily obfuscated, the heuristic firings and the presence of numerous URLs strongly suggest a malicious intent, likely related to SEO manipulation or hosting further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9810

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/6738739731738735/Control-by-William-Goldman.pdf In PDF document text
    • http://cefasfese.4pu.com/1739734730737737/Marathon-Man-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/2739735734738730/Boys-and-Girls-Together-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/5732732738732/The-Princess-Bride-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/2737736737734731/The-Princess-Bride-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/1733739732732733/Boys-and-Girls-Together-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/4735733733737/The-Princess-Bride-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/6735734735737/The-Colour-of-Light-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/5733737731730/The-Big-Picture-Who-Killed-Hollywood-and-Other-Essays-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/6738739730734738/When-Money-Was-In-Fashion-Henry-Goldman-Goldman-Sachs-and-the-Founding-of-Wall-Street-by-June-Breton-Fisher.pdfIn PDF document text
    • http://cefasfese.4pu.com/3735733733731731/The-Princess-Bride-S-Morgenstern-s-Classic-Tale-of-True-Love-and-High-Adventure-by-William-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/3732732738732737/The-Silent-Cry-William-Monk-8-by-Anne-Perry.pdfIn PDF document text
    • http://cefasfese.4pu.com/4734736739732737/The-Awful-End-of-Prince-William-the-Silent-The-First-Assassination-of-a-Head-of-State-with-a-Handgun-by-Lisa-Jardine.pdfIn PDF document text
    • http://cefasfese.4pu.com/5734739733732/The-Silent-Soldiers-Back-To-School-The-Silent-Soldiers-2-by-Travis-Stinnett.pdfIn PDF document text
    • http://cefasfese.4pu.com/4736731739732736/A-Silent-Voice-Volume-2-A-Silent-Voice-2-by-Yoshitoki-Oima.pdfIn PDF document text
    • http://cefasfese.4pu.com/8734738/A-Silent-Voice-Volume-1-A-Silent-Voice-1-by-Yoshitoki-Oima.pdfIn PDF document text
    • http://cefasfese.4pu.com/2734737733736738/Silent-No-More-Silent-1-by-N-E-Henderson.pdfIn PDF document text
    • http://cefasfese.4pu.com/3738733737738739/A-Silent-Canvas-Part-1-A-Silent-Canvas-1-by-Melissa-Ann.pdfIn PDF document text
    • http://cefasfese.4pu.com/8732737731735/Say-Her-Name-by-Francisco-Goldman.pdfIn PDF document text
    • http://cefasfese.4pu.com/1735733734733736/Myself-as-Witness-by-James-Goldman.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.