Malicious PDF — malware analysis report

Static analysis result for SHA-256 a3448559563fb6d2…

MALICIOUS

PDF

17.9 KB Created: 2019-11-28 22:37:33 +00:00 Authoring application: mPDF 5.7
MD5: 1480a7117d327139926b7ed737924233 SHA-1: 5dec264d97d4a2baf81ab418b013cf9e0e82eb88 SHA-256: a3448559563fb6d2d3bbead8201a35b0173f18bd7be189b63ccd66a455061ae8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded links pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The dominant host for these links is 'cefasfese.4pu.com'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2736735733735735/Jenna-Starborn-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/2730730733734739/The-Shape-Changer-s-Wife-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1731732731730735/General-Winston-s-Daughter-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1736734737730735/Royal-Airs-Elemental-Blessings-2-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1730737736738/Troubled-Waters-Elemental-Blessings-1-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/3739735733731736/The-Thirteenth-House-Twelve-Houses-2-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/3735730731735739/Mystic-and-Rider-Twelve-Houses-1-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1734731739731733/The-Dream-Maker-s-Magic-Safe-Keepers-3-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1733732737738732/The-Truth-Teller-s-Tale-Safe-Keepers-2-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/9730734730732730/Fortune-and-Fate-Twelve-Houses-5-Audible-Audiobook-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/9730733739733731/Reader-and-Raelynx-Twelve-Houses-4-Audible-Audiobook-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/1734732734736733/The-Safe-Keeper-s-Secret-Safe-Keepers-1-by-Sharon-Shinn.pdf
    • http://cefasfese.4pu.com/2739735738737737/The-Crystal-Channelers-and-the-Revenge-of-the-Kolob-by-Sharon-Ann-Rowland.pdf
    • http://cefasfese.4pu.com/3737731737739730/Crystal-Soldier-The-Great-Migration-Duology-1-Liaden-Universe-1-by-Sharon-Lee.pdf
    • http://cefasfese.4pu.com/1736733735731734/Crystal-Soldier-The-Great-Migration-Duology-1-Liaden-Universe-1-by-Sharon-Lee.pdf
    • http://cefasfese.4pu.com/8731734738731/Crystal-Therapy-How-to-Heal-and-Empower-Your-Life-with-Crystal-Energy-by-Doreen-Virtue.pdf
    • http://cefasfese.4pu.com/1737730730730732/Fractured-Crystal-Sapphires-and-Submission-The-Crystal-Fragments-Trilogy-1-by-M-J-Lawless.pdf
    • http://cefasfese.4pu.com/2735732737736736/Refracted-Crystal-Diamonds-and-Desire-The-Crystal-Fragments-Trilogy-3-by-M-J-Lawless.pdf
    • http://cefasfese.4pu.com/1730733736738736738/Crystal-Energy-A-Practical-Guide-to-the-Use-of-Crystal-Cards-for-Rejuvenation-and-Health-by-Monnica-Hackl.pdf
    • http://cefasfese.4pu.com/9735731734737/Crystal-Promise-The-Shattered-Crystal-1-by-James-Funfer.pdf
    • http://cefasfese.4pu.com/9730733739733731/Reader-and-Raelynx-Twelve-

Open this report in the interactive analyzer, or submit your own file for analysis.