Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf4a5eaf99b99bfa…

MALICIOUS

PDF

14.6 KB Created: 2019-05-03 05:04:27 +01:00 Authoring application: mPDF 5.7
MD5: d9cd21db683fd4e327a7200f64206869 SHA-1: f14ed19e053b984bd02ac4eadc9a6c26422269e6 SHA-256: bf4a5eaf99b99bfa769976c878b967fa337627d195475b5177feb4c1f62919fd
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this PDF as malicious. The primary attack pattern involves directing users to a domain hosting a link farm, likely as a precursor to a more direct malicious download or phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/3734738738738733/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4735733731739735/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4737735731731732/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/6735732732732739/The-Gunslinger-The-Dark-Tower-1-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/6736738732738730/Dark-Tower-I-The-Gunslinger-Film-Tie-In-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/3734738738738734/The-Dark-Tower-The-Dark-Tower-7-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/6735732733735730/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/3734739733732739/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4730732735736737/Wolves-of-the-Calla-The-Dark-Tower-5-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4739730730739739/The-Waste-Lands-The-Dark-Tower-3-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/2737736732732738/Song-of-Susannah-The-Dark-Tower-6-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/3734734737738/Song-of-Susannah-The-Dark-Tower-6-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4730736735731/The-Dark-Tower-The-Gunslinger-Born-by-Peter-David.pdf
    • http://cefasfese.4pu.com/2733733734739731/The-Dark-Tower-The-Gunslinger---The-Journey-Begins-by-Robin-Furth.pdf
    • http://cefasfese.4pu.com/3734734735736/The-Dark-Half-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/8735731731739/The-Dark-Half-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/4730738737730732/Everything-s-Eventual-14-Dark-Tales-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/2731732739731733/Full-Dark-No-Stars-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/3731733734734736/Full-Dark-No-Stars-by-Stephen-King.pdf
    • http://cefasfese.4pu.com/3737739730732732/Stephen-King-s-Battleground-A-Commemoration-of-the-Emmy-Winning-Television-Adaptation-by-Stephen-King.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.