Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a4fdd04db4545a1…

MALICIOUS

PDF

39.1 KB Created: 2019-11-09 22:40:53 +00:00 Authoring application: mPDF 5.7
MD5: fe1c8c8c6c5aea9bff78efb2ce2232a7 SHA-1: 69c577331aecfeb29a72a252f878ba85cd1c8650 SHA-256: 7a4fdd04db4545a171b40512b01e785951344f25da6c1bb368fae32442ab6733
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. This is indicative of SEO poisoning or a similar tactic to drive traffic to potentially malicious content. The ML classifier also flagged the document as malicious. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of its specific intent beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9703

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1730733734735733733/Bahnhof-in-England-Bahnhof-in-Devon-Bahnhof-in-London-Liste-Der-Bahnhofe-in-London-Bahnhof-Paddington-Bahnhof-West-Hampstead-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734735737738/Bahnhof-in-London-Liste-Der-Bahnhofe-in-London-Bahnhof-Paddington-Bahnhof-West-Hampstead-Bahnhof-St-Pancras-Bahnhof-Crystal-Palace-by-Source-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734736736738/U-Bahnhof-in-Nurnberg-Liste-Der-Nurnberger-U-Bahnhofe-U-Bahnhof-Hauptbahnhof-U-Bahnhof-Plarrer-U-Bahnhof-Friedrich-Ebert-Platz-U-Bahnhof-Aufsessplatz-U-Bahnhof-Barenschanze-U-Bahnhof-Opernhaus-U-Bahnhof-Nordostbahnhof-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734735733731/U-Bahnhof-in-Der-Prafektur-Tokio-Bahnhof-Shinjuku-Bahnhof-Ueno-Bahnhof-Ikebukuro-Bahnhof-Shibuya-Bahnhof-Ochanomizu-Bahnhof-Akihabara-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734735737732/Bahnhof-in-Russland-Bahnhof-in-Moskau-Bahnhof-in-Sankt-Petersburg-Liste-Der-Bahnhofe-in-Moskau-Jaroslawler-Bahnhof-Fili-Elektrosawodskaja-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734736737730/Bahnhof-in-Koln-U-Bahnhof-in-Koln-Koln-Hauptbahnhof-Bahnhof-Koln-Messe-Deutz-Liste-Kolner-Bahnhofe-Bahnhof-Koln-Bonn-Flughafen-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734736738730/Bahnhof-Hessen-Liste-Der-Personenbahnhofe-in-Hessen-Bahnhof-Kassel-Wilhelmshohe-Bahnhofe-in-Friedrichsdorf-Bahnhof-Fulda-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734736738731/Bahnhof-in-Stuttgart-Stuttgart-Hauptbahnhof-Bahnhof-Stuttgart-Bad-Cannstatt-Liste-Der-Bahnhofe-in-Stuttgart-Bahnhof-Stuttgart-West-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734738734731/Metro-Lissabon-U-Bahnhof-in-Lissabon-Liste-Der-Lissabonner-U-Bahnhofe-Bahnhof-Lissabon-Cais-Do-Sodre-Bahnhof-Lissabon-Santa-Apolon-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734736737738/Bahnhof-Im-Vereinigten-Konigreich-Bahnhof-in-England-Bahnhof-in-Schottland-Manchester-Piccadilly-Station-Leeds-City-Station-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734735737730/Bahnhof-in-Japan-Bahnhof-in-Der-Prafektur-Chiba-Bahnhof-in-Der-Prafektur-Kanagawa-Bahnhof-in-Der-Prafektur-Saitama-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/9732730737731731/Bahnhof-in-Munchen-Bahnhof-Munchen-Pasing-Munchen-Hauptbahnhof-Bahnhof-Munchen-Ost-Bahnhof-Munchen-Trudering-Bahnhof-Munchen-Marienplatz-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734735736738/Bahnhof-in-Dresden-Dresden-Hauptbahnhof-Bahnhof-Dresden-Neustadt-Bahnhof-Dresden-Friedrichstadt-Dresden-Leipziger-Bahnhof-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734738734736/Bahnhof-in-Berlin-Bahnhof-Berlin-Zoologischer-Garten-Bahnhof-Berlin-Lichtenberg-Berlin-Hauptbahnhof-Liste-Der-Bahnhofe-Im-Raum-Berlin-by-Books-LLC.pdf
    • http://cefasfese.4pu.com/1730733734735737735/Bahnhof-Im-Kanton-Zurich-Bahnhof-in-Winterthur-Bahnhof-in-Zurich-Zurich-Hauptbahnhof-Winterthur-Hauptbahnhof-Bahnhof-Stettbach-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/9730738739734736/Bauwerk-in-Flensburg-Kirchengebaude-in-Flensburg-Duborg-Skolen-Nikolaikirche-Marineschule-Murwik-Bahnhof-Flensburg-Landgericht-Flensburg-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730738733730737736/Verkehrsbauwerk-in-Aachen-Bahnhof-in-Aachen-Platz-in-Aachen-Strasse-in-Aachen-Bundesstrasse-1-Bundesautobahn-44-Vennbahn-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730739738730733731/Verkehrsbauwerk-in-Danemark-Bahnhof-in-Danemark-Brucke-in-Danemark-Flughafen-Danemark-Hafen-in-Danemark-Oresundbrucke-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730736733739733739/Gebaude-in-Oberosterreich-Alpenhutte-Oberosterreich-Bahnhof-in-Oberosterreich-Burg-in-Oberosterreich-Kirchengebaude-in-Oberosterreich-by-Quelle-Wikipedia.pdf
    • http://cefasfese.4pu.com/1730733734737736738/Tomas-Saraceno-by-D-Sseldorf-Hamburger-Bahnhof.pdf