Malicious PDF — malware analysis report

Static analysis result for SHA-256 9816429945dc79cd…

MALICIOUS

PDF

20.8 KB Created: 2019-09-27 13:20:47 +01:00 Authoring application: mPDF 5.7
MD5: 023533285f4ac0fdb91c18cbab885883 SHA-1: 6f85914aeca506d7fd73203bde8561562dbdefdf SHA-256: 9816429945dc79cd46d3c1a642bedcd703dfe807c57430a3bae6c90bf01bec1e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier and contains a large number of embedded links, indicating a link farm or SEO abuse tactic. The primary heuristic identified a "PDF_SEO_LINK_FARM" with 26 external PDF links, suggesting the document's purpose is to direct users to potentially malicious or unwanted content hosted on the `cefasfese.4pu.com` domain. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9805

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9738735734731739/The-Turn-of-the-Screw-by-Henry-James-Illustrated-Delphi-Parts-Edition-Henry-James-by-Henry-James.pdf
    • http://cefasfese.4pu.com/7739736739739735/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/4736730734735731/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/8737737730739739/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/6730735739737734/Turn-of-the-screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/1735734737733738/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/7736732737730734/Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/7739739738736732/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/1730735732731736733/The-Turn-of-the-Screw-by-Henry-James.pdf
    • http://cefasfese.4pu.com/1730734732730736736/The-Turn-of-the-Screw-with-eBook-by-Henry-James.pdf
    • http://cefasfese.4pu.com/1739734732731739/The-Turn-of-the-Screw-and-Other-Short-Fiction-by-Henry-James.pdf
    • http://cefasfese.4pu.com/8730737735731739/The-Turn-of-the-Screw-Gothic-Fiction-Book-3-by-Henry-James.pdf
    • http://cefasfese.4pu.com/5733731738735731/The-Turn-of-the-Screw-Annotated-The-Study-Guide-Edition-Creative-Study-Guide-Editions-Book-8-by-Henry-James.pdf
    • http://cefasfese.4pu.com/9738735732739737/Dubliners-by-James-Joyce-Illustrated-Delphi-Parts-Edition-James-Joyce-by-James-Joyce.pdf
    • http://cefasfese.4pu.com/4739737731730733/The-New-York-Stories-of-Henry-James-by-Henry-James.pdf
    • http://cefasfese.4pu.com/1733737739733732/Henry-James-A-Life-in-Letters-by-Henry-James.pdf
    • http://cefasfese.4pu.com/9738735734731738/The-Portrait-Of-A-Lady-Parts-1-amp-2-by-Henry-James.pdf
    • http://cefasfese.4pu.com/8730732733738734/BEL-AMI-THE-HISTORY-OF-A-SCOUNDREL-From-one-of-the-greatest-French-writers-widely-regarded-as-the-Father-of-Short-Story-writing-who-had-influenced-O-Henry-Anton-Chekhov-and-Henry-James-by-Guy-de-Maupassant.pdf
    • http://cefasfese.4pu.com/9732732730730739/The-Portrait-of-a-Lady-1000-Copy-Limited-Edition-by-Henry-James.pdf
    • http://cefasfese.4pu.com/7730734734733733/People-From-Edwardsville-Illinois-James-W-Stephenson-James-D-Henry-Lloyd-Kropp-Edward-Coles-Sampson-Avard-Darin-Gray-William-H-Berry-by-Books-LLC.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.