Malicious PDF — malware analysis report

Static analysis result for SHA-256 a327e5ea2a5a74e0…

MALICIOUS

PDF

18.7 KB Created: 2019-05-24 17:47:20 +01:00 Authoring application: mPDF 5.7
MD5: aaad718263dbc1e46e073afc1847037b SHA-1: d81e8e0047d834dedd3596817c81fb7c9b355667 SHA-256: a327e5ea2a5a74e017ceec8b115ee0dc5455faaa476a80fdb3a9eea6a3e6e0e4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of external links, many of which point to PDFs hosted on the suspicious domain 'cefasfese.4pu.com'. This indicates a link farm or redirection scheme designed to lead users to potentially malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2735738739732734/A-History-of-the-Jews-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/3736737733732738/A-History-of-Christianity-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/1733738736738738/A-History-of-the-American-People-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/2733731732733730/Jews-and-American-Comics-An-Illustrated-History-of-an-American-Art-Form-by-Paul-M-Buhle.pdf
    • http://cefasfese.4pu.com/4730733730734733/History-of-the-Jews-in-the-Netherlands-by-J-C-H-Blom.pdf
    • http://cefasfese.4pu.com/7732735735737732/History-of-the-Jews-in-Aragon-by-Jean-R-gn-.pdf
    • http://cefasfese.4pu.com/8738732731733739/A-Short-History-of-the-Jews-by-Michael-Brenner.pdf
    • http://cefasfese.4pu.com/9737732737733/Rasputin-and-the-Jews-A-Reversal-of-History-by-Delin-Col-n.pdf
    • http://cefasfese.4pu.com/1730736736732737738/Why-Jews-Do-What-They-Do-The-History-Of-Jewish-Customs-Throughout-The-Cycle-Of-The-Jewish-Year-by-Daniel-Sperber.pdf
    • http://cefasfese.4pu.com/9733732739738739/Stalin-The-Kremlin-Mountaineer-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/4738736737736739/Sam-Patch-the-Famous-Jumper-by-Paul-E-Johnson.pdf
    • http://cefasfese.4pu.com/7735734737732730/George-Washington-The-Founding-Father-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/8737736736735/The-Birth-of-the-Modern-World-Society-1815-1830-by-Paul-Johnson.pdf
    • http://cefasfese.4pu.com/2730731731739731/Listening-in-Paris-A-Cultural-History-by-James-H-Johnson.pdf
    • http://cefasfese.4pu.com/1730734737734733/The-Churchill-Factor-How-One-Man-Made-History-by-Boris-Johnson.pdf
    • http://cefasfese.4pu.com/4736734739738/Sleepwalking-Through-History-America-in-the-Reagan-Years-by-Haynes-Johnson.pdf
    • http://cefasfese.4pu.com/4736737739731/America-Is-Born-A-History-for-Peter-by-Gerald-White-Johnson.pdf
    • http://cefasfese.4pu.com/2730730731735739/A-Shopkeeper-s-Millennium-Society-and-Revivals-in-Rochester-New-York-1815-1837-by-Paul-E-Johnson.pdf
    • http://cefasfese.4pu.com/4736733737734739/The-Feather-Thief-Beauty-Obsession-and-the-Natural-History-Heist-of-the-Century-by-Kirk-W-Johnson.pdf
    • http://cefasfese.4pu.com/4739735730739731/The-Feather-Thief-Beauty-Obsession-and-the-Natural-History-Heist-of-the-Century-by-Kirk-W-Johnson.pdf
    • http://cefasfese.4pu.com/1730736736732737738/Why-Jews-Do-What-They-Do-The-History-Of-Jewish-Customs-Throughout-The-Cycle-Of-The-Jewish-Year-by-Daniel

Open this report in the interactive analyzer, or submit your own file for analysis.