Malicious PDF — malware analysis report

Static analysis result for SHA-256 a666523976b71f9f…

MALICIOUS

PDF

19.3 KB Created: 2019-11-09 22:28:26 +00:00 Authoring application: mPDF 5.7
MD5: 3957bb384f790e8377e14f8c88b704fd SHA-1: 4c96edf2220269b06cebfa47129d7817ab525254 SHA-256: a666523976b71f9f497f0824c4e61791ba95927c03c26c133d6e3a35062c883c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. While the document body is heavily corrupted, the presence of numerous links suggests a tactic to redirect users to potentially malicious content or to engage in SEO poisoning. The ML_NYX_PDF_MALICIOUS classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9940

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu
    • http://cefasfese.4pu.com/1733732731739/See-You-at-Harry-s-by-Jo-Knowles.pdf
    • http://cefasfese.4pu.com/1731730732733737731/Iona-by-E-M-Knowles.pdf
    • http://cefasfese.4pu.com/5732735737732733/Harry-Potter-and-the-Chamber-of-Secrets---Harry-Potter-dan-Kamar-Rahasia-Harry-Potter-2-by-J-K-Rowling.pdf
    • http://cefasfese.4pu.com/4732732733738738/Still-a-Work-in-Progress-by-Jo-Knowles.pdf
    • http://cefasfese.4pu.com/2737738734732737/Promises-Kept-by-Erosa-Knowles.pdf
    • http://cefasfese.4pu.com/1736730734732731/Concubine-by-Jill-Knowles.pdf
    • http://cefasfese.4pu.com/9732739732732735/Worn-by-Richard-Knowles.pdf
    • http://cefasfese.4pu.com/8738738735730/Awake-Unto-Me-by-Kathleen-Knowles.pdf
    • http://cefasfese.4pu.com/4731733731733732/Lessons-from-a-Dead-Girl-by-Jo-Knowles.pdf
    • http://cefasfese.4pu.com/1736737735734737/The-Ezekiel-Project-by-Christina-Knowles.pdf
    • http://cefasfese.4pu.com/2734735730739732/Lyon-on-a-Leash-by-Erosa-Knowles.pdf
    • http://cefasfese.4pu.com/5737734738739733/The-Legends-of-King-Arthur-and-His-Knights-by-James-Knowles.pdf
    • http://cefasfese.4pu.com/1732735733733737/Living-with-Jackie-Chan-Jumping-Off-Swings-2-by-Jo-Knowles.pdf
    • http://cefasfese.4pu.com/9735739732732739/A-Separate-Peace-with-related-Readings-by-John-Knowles.pdf
    • http://cefasfese.4pu.com/4736730735731731/Harry-s-Last-Stand-How-the-World-My-Generation-Built-is-Falling-Down-and-What-We-Can-Do-to-Save-It-by-Harry-Leslie-Smith.pdf
    • http://cefasfese.4pu.com/5737737734739/Uncle-Harry-s-Stories-Looking-Back-Blackly-and-Proudly-Growing-Up-in-America-by-Harry-R-Irving.pdf
    • http://cefasfese.4pu.com/3739732735737731/The-Wayward-Daughter-Shadow-Souls-MC-Book-1-by-Tamara-Knowles.pdf
    • http://cefasfese.4pu.com/5730730733736732/Secret-History-of-Rock-n-Roll-The-Mysterious-Roots-of-Modern-Music-by-Christopher-Knowles.pdf
    • http://cefasfese.4pu.com/3738735739739739/The-Harry-Bosch-Mysteries-Volume-2-The-Last-Coyote-Trunk-Music-Angels-Flight-Harry-Bosch-4-6-by-Michael-Connelly.pdf
    • http://cefasfese.4pu.com/4738734735739736/The-Harry-Bosch-Novels-Volume-3-A-Darkness-More-Than-Night-City-of-Bones-Lost-Light-Harry-Bosch-7-9-by-Michael-Connelly.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.