Malicious PDF — malware analysis report

Static analysis result for SHA-256 9889198bc950aa8b…

MALICIOUS

PDF

18.7 KB Created: 2019-05-02 05:09:06 +01:00 Authoring application: mPDF 5.7
MD5: b195e64c3955821973cc100df99d2049 SHA-1: e8a2893c8fb8f0d78c055e5876fbdedceeb79a5d SHA-256: 9889198bc950aa8ba76b2e21f645ad016e0efb82d5775884e165dd07a59a0a7c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF was flagged by a machine learning classifier and contains a large number of external links, many of which point to other PDFs. The embedded URLs are structured as a link farm, likely intended to drive traffic or potentially host malicious content disguised as legitimate documents. The primary attack pattern involves directing users to a domain hosting numerous files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2732739731731736/Shadow-Walker-Spirit-Walker-2-by-James-Galloway.pdf
    • http://cefasfese.4pu.com/1731736736739/Shadow-Walker-Stormwalker-3-by-Allyson-James.pdf
    • http://cefasfese.4pu.com/5733738731736731/Unlocking-the-Patmos-Code-by-Walker-William-Walker.pdf
    • http://cefasfese.4pu.com/3734738737737738/Walker-Pride-The-Walker-Family-1-by-Bernadette-Marie.pdf
    • http://cefasfese.4pu.com/4733739739734/Spirit-Walker-Chronicles-of-Ancient-Darkness-2-by-Michelle-Paver.pdf
    • http://cefasfese.4pu.com/7731734731/Wings-of-the-Walker-The-Walker-1-by-Coralee-June.pdf
    • http://cefasfese.4pu.com/7732731735733730/Fight-of-the-Walker-The-Walker-3-by-Coralee-June.pdf
    • http://cefasfese.4pu.com/2732738739739736/The-Shadow-Realm-Firestaff-series-4-by-James-Galloway.pdf
    • http://cefasfese.4pu.com/4735730732737736/Shadow-Walker-Flame-Set-2-by-Connie-Mason.pdf
    • http://cefasfese.4pu.com/2733733738735731/Shadow-Walker-A-Neteru-Academy-Book-by-L-A-Banks.pdf
    • http://cefasfese.4pu.com/1732738739730732/Code-Name-Johnny-Walker-The-Extraordinary-Story-of-the-Iraqi-Who-Risked-Everything-to-Fight-with-the-U-S-Navy-SEALs-by-Johnny-Walker.pdf
    • http://cefasfese.4pu.com/3739732734737738/Hana-Walker-s-Half-Life-2-46-Hana-Walker-Mysteries-1-by-Our-Man-in-Abiko.pdf
    • http://cefasfese.4pu.com/3734738734739738/Danielle-Walker-s-Against-All-Grain-Meals-Made-Simple-Gluten-Free-Dairy-Free-and-Paleo-Recipes-to-Make-Anytime-by-Danielle-Walker.pdf
    • http://cefasfese.4pu.com/3733731738734733/Affrilachia-Poems-by-Frank-X-Walker-by-Frank-X-Walker.pdf
    • http://cefasfese.4pu.com/1739736733733733/Realm-Walker-Realm-Walker-1-by-Kathleen-Collins.pdf
    • http://cefasfese.4pu.com/7734732732739730/Gettysburg-Description-of-the-Painting-of-the-Repulse-of-Longstreet-s-Assault-Painted-by-James-Walker-by-John-B-Bachelder.pdf
    • http://cefasfese.4pu.com/7734732732738739/Gettysburg-Description-of-the-Painting-of-the-Repulse-of-Longstreet-s-Assault-Painted-by-James-Walker-by-John-Badger-From-Old-Catalo-Bachelder.pdf
    • http://cefasfese.4pu.com/2735736733738730/Ten-in-the-Bin-by-N-R-Walker.pdf
    • http://cefasfese.4pu.com/2732739730730735/Unification-Subjugation-3-by-James-Galloway.pdf
    • http://cefasfese.4pu.com/2732739731734731/Secession-Subjugation-5-by-James-Galloway.pdf
    • http://cefasfese.4pu.com/1732738739730732/Code-Name-Johnny-Walker-The-Extraordinary-Story-of-the-Iraqi-Who-Risked-Everything-to-Fight-with-the-U-S-Navy-SEALs-by-Johnny-

Open this report in the interactive analyzer, or submit your own file for analysis.