Malicious PDF — malware analysis report

Static analysis result for SHA-256 9913059f527089b6…

MALICIOUS

PDF

16.9 KB Created: 2019-06-04 15:07:42 +01:00 Authoring application: mPDF 5.7
MD5: dd47d0ced37316dc3cd90bcb33630efc SHA-1: aa2b48f170a9b4a3d8dbdd41f568e936fc863aa6 SHA-256: 9913059f527089b634ae782d1417e761ffcb6d04b40225a875aed0e8b4efe544
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1190 Exploit Public-Facing Application

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The primary function appears to be hosting a link farm, likely for SEO manipulation or to distribute further malicious content, rather than containing a direct exploit or payload within the PDF itself.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4732734739736733/The-Collected-Works-of-George-MacDonald-The-Complete-Works-PergamonMedia-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/4730739732734731/The-Complete-McAuslan-by-George-MacDonald-Fraser.pdf
    • http://cefasfese.4pu.com/4732735732730730/3000-Quotations-from-the-Writings-of-George-MacDonald-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/3733738735731731/Modern-Wicked-Fairy-Tales-The-Complete-Collection-by-Selena-Kitt.pdf
    • http://cefasfese.4pu.com/6730738735735731/The-Christmas-Stories-of-George-MacDonald-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/2733739739734734/The-George-MacDonald-Treasury-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/5738738731731733/The-Complete-Grimm-s-Fairy-Tales-The-Original-Classics---Illustrated-by-Jacob-Grimm.pdf
    • http://cefasfese.4pu.com/2738736736734736/The-Complete-Fairy-Tales-of-Brothers-Grimm-Volume-1-by-Jacob-Grimm.pdf
    • http://cefasfese.4pu.com/1730737739730739732/Fairy-Tales-complete-original-story-Biography-Brothers-Grimm-amp-bonus-50-illustration-by-Jacob-Grimm.pdf
    • http://cefasfese.4pu.com/2733733730735737/Grimms-Fairy-Tales-and-Andersen-s-Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://cefasfese.4pu.com/4733739733737737/Teapot-Tales-A-Collection-of-Unique-Fairy-Tales-by-Rebecca-Fyfe.pdf
    • http://cefasfese.4pu.com/9731735739738/Her-Stories-African-American-Folktales-Fairy-Tales-and-True-Tales-by-Virginia-Hamilton.pdf
    • http://cefasfese.4pu.com/2733731732736730/Grimm-Fairy-Tales-Tales-from-Wonderland-vol-1-by-Raven-Gregory.pdf
    • http://cefasfese.4pu.com/1738735736738736/Phantastes-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/3739738738738739/Lilith-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/4735730739736731/Getting-To-Know-Jesus-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/2730735730737736/The-Giant-s-Heart-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/2737731733731739/Your-Life-in-Christ-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/4732738730730732/The-Princess-And-The-Goblin-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/1738730735736739/The-Princess-and-Curdie-by-George-MacDonald.pdf
    • http://cefasfese.4pu.com/1730737739730739732/Fairy-Tales-complete-original-story-Biograph

Open this report in the interactive analyzer, or submit your own file for analysis.