Malicious PDF — malware analysis report

Static analysis result for SHA-256 94fb50498abe2a77…

MALICIOUS

PDF

19.7 KB Created: 2019-09-27 13:24:32 +01:00 Authoring application: mPDF 5.7
MD5: 3635de0d6c3db1c40be5fded109f2b4e SHA-1: 7fc68aa8673d04c5fab2f5cf14ab586a90d9729d SHA-256: 94fb50498abe2a7703c36d7dc69421fa4ea21201aba24c19005e95da7a8ca3ce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external websites, as indicated by the PDF_SEO_LINK_FARM heuristic. While the specific URLs extracted are currently flagged as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to redirect users to malicious content. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4732734731732738/Red-Velvet-Underground-A-Rock-Memoir-with-Recipes-by-Freda-Love-Smith.pdf
    • http://cefasfese.4pu.com/8738739734733732/All-Yesterdays-Parties-The-Velvet-Underground-in-Print-1966-1971-by-Clinton-Heylin.pdf
    • http://cefasfese.4pu.com/1730737730733730732/The-Velvet-Underground-Companion-Four-Decades-Of-Commentary-The-Companion-Series-by-Albin-Zak-III.pdf
    • http://cefasfese.4pu.com/3737730734734738/Letters-from-Wishing-Rock-a-novel-with-recipes-Wishing-Rock-1-by-Pam-Stucky.pdf
    • http://cefasfese.4pu.com/4731732738736/The-Velvet-Promise-Velvet-Montgomery-Annuals-Quadrilogy-1-by-Jude-Deveraux.pdf
    • http://cefasfese.4pu.com/1739734737733731/Letters-from-Wishing-Rock-A-novel-with-recipes-by-Pam-Stucky.pdf
    • http://cefasfese.4pu.com/4733737735735730/Apricots-on-the-Nile-A-Memoir-with-Recipes-by-Colette-Rossant.pdf
    • http://cefasfese.4pu.com/3734738737731732/Picnic-in-Provence-A-Memoir-with-Recipes-by-Elizabeth-Bard.pdf
    • http://cefasfese.4pu.com/2735739731735736/Velvet-Velvet-1-by-Temple-West.pdf
    • http://cefasfese.4pu.com/1738733731732731/Vegan-with-a-Vengeance-Over-150-Delicious-Cheap-Animal-Free-Recipes-That-Rock-by-Isa-Chandra-Moskowitz.pdf
    • http://cefasfese.4pu.com/1730732736733733732/On-Leopard-Rock-A-Life-of-Adventures-by-Wilbur-Smith.pdf
    • http://cefasfese.4pu.com/7730732739731730/On-Leopard-Rock-A-Life-of-Adventures-by-Wilbur-Smith.pdf
    • http://cefasfese.4pu.com/4731735737738731/Warriors-Don-t-Cry-A-Searing-Memoir-of-the-Battle-to-Integrate-Little-Rock-s-Central-High-by-Melba-Pattillo-Beals.pdf
    • http://cefasfese.4pu.com/2739731730737738/Fall-to-Pieces-A-Memoir-of-Drugs-Rock-n-Roll-and-Mental-Illness-by-Mary-Forsberg-Weiland.pdf
    • http://cefasfese.4pu.com/1739731731733/Name-All-the-Animals-A-Memoir-by-Alison-Smith.pdf
    • http://cefasfese.4pu.com/2739735733731738/I-Love-a-Man-in-Uniform-A-Memoir-of-Love-War-and-Other-Battles-by-Lily-Burana.pdf
    • http://cefasfese.4pu.com/7734738739735/The-Frugal-Gourmet-on-Our-Immigrant-Ancestors-Recipes-You-Should-Have-Gotten-from-Your-Grandmother-by-Jeff-Smith.pdf
    • http://cefasfese.4pu.com/3732737730730731/Forbidden-Fruit-Love-Stories-from-the-Underground-Railroad-by-Betty-DeRamus.pdf
    • http://cefasfese.4pu.com/1737739737730733/Monkey-Mind-A-Memoir-of-Anxiety-by-Daniel-B-Smith.pdf
    • http://cefasfese.4pu.com/1731732731737731731/Rock-Hard-Love-Rock-Hard-1-by-D-H-Cameron.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.