Malicious PDF — malware analysis report

Static analysis result for SHA-256 9565744a0af390ed…

MALICIOUS

PDF

17.5 KB Created: 2019-05-01 18:50:26 +01:00 Authoring application: mPDF 5.7
MD5: a05b2aa01d094f14be35e869864439cd SHA-1: 331909ee122e681ded6a89f5aa065b54b947a0c8 SHA-256: 9565744a0af390edb08d3a97bd055512dca09a9f066bbf9b89a7c7afa3c49aa8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs extracted are currently marked as benign, the sheer volume and structure suggest a malicious intent, likely for SEO manipulation or to serve as a landing page for further malicious activity. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9807

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/7733732733738731/The-Miser-in-the-Bush-by-Jacob-Grimm.pdf
    • http://cefasfese.4pu.com/8730738732733730/Four-Revenge-Tragedies-The-Spanish-Tragedy-The-Revenger-s-Tragedy-The-Revenge-of-Bussy-D-Ambois-And-the-Atheist-s-Tragedy-by-Katharine-Eisaman-Maus.pdf
    • http://cefasfese.4pu.com/1730739735736737732/100-Years-of-Joy-by-Shai-Weisberg.pdf
    • http://cefasfese.4pu.com/3737735737730732/The-Complete-Pat-of-Silver-Bush-Series-Pat-of-Silver-Bush-Mistress-Pat-by-L-M-Montgomery.pdf
    • http://cefasfese.4pu.com/4737730731739735/Applications-Of-Feminist-Legal-Theory-by-D-Kelly-Weisberg.pdf
    • http://cefasfese.4pu.com/9738735737735/Barney-Frank-The-Story-of-America-s-Only-Left-Handed-Gay-Jewish-Congressman-by-Stuart-Weisberg.pdf
    • http://cefasfese.4pu.com/9737739732733731/Jacob-Lauffer-s-Beschreibung-Helvetischer-Geschichte-Ed-by-J-G-Altmann-With-Vollstandiges-Register-by-Johann-Jacob-Lauffer.pdf
    • http://cefasfese.4pu.com/9734734736730735/The-Curse-of-Jacob-Tracy-Jacob-Tracy-1-by-Holly-Messinger.pdf
    • http://cefasfese.4pu.com/2735739737736735/A-Bush-Christening-by-A-B-Paterson.pdf
    • http://cefasfese.4pu.com/6739734734737733/Nowhere-Safe-Nowhere-3-by-Nancy-Bush.pdf
    • http://cefasfese.4pu.com/9735735730730732/A-Bride-from-the-Bush-by-E-W-Hornung.pdf
    • http://cefasfese.4pu.com/8731736736735739/Conviction-by-Joey-Bush.pdf
    • http://cefasfese.4pu.com/1734733739734732/Goodnight-Bush-by-Erich-Origen.pdf
    • http://cefasfese.4pu.com/5730731732735737/Love-Julie-by-Christine-Bush.pdf
    • http://cefasfese.4pu.com/1730736734732/Decision-Points-by-George-W-Bush.pdf
    • http://cefasfese.4pu.com/6733737735733/Thought-Horses-by-Rachel-Bush.pdf
    • http://cefasfese.4pu.com/9734736732731/The-Blackberry-Bush-by-David-Housholder.pdf
    • http://cefasfese.4pu.com/5730731736734734/Cowboy-Boots-by-Christine-Bush.pdf
    • http://cefasfese.4pu.com/7735732738730737/Every-Bush-Is-Burning-by-Brandon-Clements.pdf
    • http://cefasfese.4pu.com/4737739737732737/Rose-Bush-by-Stephen-Doster.pdf
    • http://cefasfese.4pu.com/9738735737735

Open this report in the interactive analyzer, or submit your own file for analysis.