Malicious PDF — malware analysis report

Static analysis result for SHA-256 93c1e755bdbbed58…

MALICIOUS

PDF

15.5 KB Created: 2019-05-03 17:23:01 +01:00 Authoring application: mPDF 5.7 First seen: 2021-06-13
MD5: 546b5f132fe1ba796503dc4da4ba8d03 SHA-1: 88e590cbf1807d0e582ab2df24a6db0b854a9bf5 SHA-256: 93c1e755bdbbed58ce335495e8148fef4e265d342bafa842c05d04f6404f95ab
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting an attempt to manipulate search engine results or distribute content. While the URLs themselves are marked as benign, the sheer volume and structure indicate a malicious intent, likely related to SEO poisoning or content distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4737735731731732/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdf In PDF document text
    • http://cefasfese.4pu.com/2731732739731733/Full-Dark-No-Stars-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/6735732732732739/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3731733734734736/Full-Dark-No-Stars-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/4735733731739735/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/4730738737730732/Everything-s-Eventual-14-Dark-Tales-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734738738738733/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/2737736732732738/Song-of-Susannah-The-Dark-Tower-6-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/6735732733735730/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734739733732739/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/4739730730739739/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734734737738/Song-of-Susannah-The-Dark-Tower-6-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/4730732735736737/Wolves-of-the-Calla-The-Dark-Tower-5-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/6736738732738730/Dark-Tower-I-The-Gunslinger-Film-Tie-In-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3737739730732732/Stephen-King-s-Battleground-A-Commemoration-of-the-Emmy-Winning-Television-Adaptation-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734738738738734/The-Dark-Tower-The-Dark-Tower-7-by-Stephen-King.pdfIn PDF document text
    • http://cefasfese.4pu.com/3730733738739730/The-Sagas-of-King-Half-and-King-Hrolf-by-W-Bryant-Bachman.pdfIn PDF document text
    • http://cefasfese.4pu.com/9735730733733734/King-Stephen-Greta-the-Witch-by-Stephen-Voller.pdfIn PDF document text
    • http://cefasfese.4pu.com/3734730739739737/The-Stephen-King-Universe-A-Guide-to-the-Worlds-of-the-King-of-Horror-by-Stanley-Wiater.pdfIn PDF document text
    • http://cefasfese.4pu.com/4732731730734739/Stephen-King-Goes-to-the-Movies-by-Stephen-King.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.