Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1637c998342ef83…

MALICIOUS

PDF

18.0 KB Created: 2019-04-30 19:27:41 +01:00 Authoring application: mPDF 5.7
MD5: 013fc29624c40ecdcacb48a6aa2ca87f SHA-1: a1e08929c87cbc0c73bda572a8c066ba068bd6dc SHA-256: c1637c998342ef83a8a79f0df3e28dfdcbdc147531b6b49c40775e63a9811aee
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded links pointing to external PDF files hosted on the domain 'cefasfese.4pu.com'. This heuristic firing, combined with the ML classifier's high confidence, suggests a link farm or redirection tactic. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate user-facing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9807

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1734739734732735/Mary-Mrs-A-Lincoln-by-Janis-Cooke-Newman.pdf
    • http://cefasfese.4pu.com/2730736733737730/Mary-by-Janis-Cooke-Newman.pdf
    • http://cefasfese.4pu.com/7733739734732739/A-Present-for-a-Papist-Or-the-History-of-the-Life-of-Pope-Joan-taken-Mainly-from-A-Cooke-s-Pope-Joane-by-Alexander-Cooke.pdf
    • http://cefasfese.4pu.com/3738733730732738/Addison-Cooke-and-the-Tomb-of-Khan-Addison-Cooke-2-by-Jonathan-W-Stokes.pdf
    • http://cefasfese.4pu.com/3739731734732736/Addison-Cooke-and-the-Treasure-of-the-Incas-Addison-Cooke-1-by-Jonathan-W-Stokes.pdf
    • http://cefasfese.4pu.com/2731735735739738/The-Real-Lincoln-A-New-Look-at-Abraham-Lincoln-His-Agenda-and-an-Unnecessary-War-by-Thomas-J-DiLorenzo.pdf
    • http://cefasfese.4pu.com/7733733737731730/The-Lincoln-Memorial-Album-Immortelles-Excerpts-by-Abraham-Lincoln.pdf
    • http://cefasfese.4pu.com/9738734736739/Vote-Lincoln-the-Presidential-Campaign-Biography-of-Abraham-Lincoln-1860-Restored-and-Annotated-by-John-Locke-Scripps.pdf
    • http://cefasfese.4pu.com/7739737736736735/Death-Before-Compline-Short-Stories-by-Sharan-Newman-by-Sharan-Newman.pdf
    • http://cefasfese.4pu.com/3734731732732736/The-Lincoln-Lawyer-Novels-The-Lincoln-Lawyer-The-Brass-Verdict-The-Reversal-by-Michael-Connelly.pdf
    • http://cefasfese.4pu.com/5739736730730731/The-Wit-and-Wisdom-of-Abraham-Lincoln-A-Book-of-Quotations-by-Abraham-Lincoln.pdf
    • http://cefasfese.4pu.com/3738732737738730/Going-Down-with-Janis-by-Peggy-Caserta.pdf
    • http://cefasfese.4pu.com/3739732734735733/The-Realization-by-Ida-Haig-Janis.pdf
    • http://cefasfese.4pu.com/6731732733736733/Aime-Cesaire-by-Janis-L-Pallister.pdf
    • http://cefasfese.4pu.com/7733736737732738/Roy-Lichtenstein-1923-1997-by-Janis-Hendrickson.pdf
    • http://cefasfese.4pu.com/5731739732735734/Janis-Joplin-Rise-Up-Singing-by-Ann-Angel.pdf
    • http://cefasfese.4pu.com/7730737732733731/Alleluia-a-Gospel-Diary-by-Janis-Walker.pdf
    • http://cefasfese.4pu.com/1732736738732/Angel-on-a-Harley-by-Janis-Reams-Hudson.pdf
    • http://cefasfese.4pu.com/1732739739737/Foster-Love-by-Janis-Reams-Hudson.pdf
    • http://cefasfese.4pu.com/8731737730731734/Joan-Miro-1893-1983-by-Janis-Mink.pdf
    • http://cefasfese.4pu.com/9738734736739/Vote-Lincoln

Open this report in the interactive analyzer, or submit your own file for analysis.