Malicious PDF — malware analysis report

Static analysis result for SHA-256 c4054b9e80c07f6f…

MALICIOUS

PDF

18.0 KB Created: 2019-05-27 13:15:36 +01:00 Authoring application: mPDF 5.7
MD5: 2cc16cf43127b47cad32dccfaaa4749c SHA-1: cf304ae8638baed76949fb877adca169effdc1b8 SHA-256: c4054b9e80c07f6fbd1dd77de890b86f338884ac0351c944cb6a129769b1502e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a malicious intent, likely to manipulate search engine results or redirect users to harmful sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2739736731735/The-Valdez-Horses-by-Lee-Hoffman.pdf
    • http://cefasfese.4pu.com/2731737734731734/Wench-by-Dolen-Perkins-Valdez.pdf
    • http://cefasfese.4pu.com/3734734734735730/Valdez-Is-Coming-A-Novel-by-Elmore-Leonard.pdf
    • http://cefasfese.4pu.com/5736733730738734/The-Valet-Man-Acts-of-Kindness-by-Henry-Valdez.pdf
    • http://cefasfese.4pu.com/8735732733735734/Journal-of-the-Commons-House-of-Assembly-of-South-Carolina-1693-by-South-Carolina-Assembly.pdf
    • http://cefasfese.4pu.com/2731733731739731/Child-of-the-Dark-The-Diary-of-Carolina-Maria-de-Jesus-by-Carolina-Maria-de-Jesus.pdf
    • http://cefasfese.4pu.com/3738734735738730/The-Cold-Cold-Ground-Detective-Sean-Duffy-1-by-Adrian-McKinty.pdf
    • http://cefasfese.4pu.com/4738734737739738/The-Cold-Cold-Ground-Detective-Sean-Duffy-1-by-Adrian-McKinty.pdf
    • http://cefasfese.4pu.com/3731738739733734/Cold-Fear-Cold-Justice-4-by-Toni-Anderson.pdf
    • http://cefasfese.4pu.com/4731735738737732/Cold-Blooded-Cold-Justice-9-by-Toni-Anderson.pdf
    • http://cefasfese.4pu.com/2739734735736738/Cold-Blooded-Cold-Justice-9-by-Toni-Anderson.pdf
    • http://cefasfese.4pu.com/3735736731731739/Cold-Stone-Cold-Fox-Trilogy-2-by-Max-Monroe.pdf
    • http://cefasfese.4pu.com/4731734737737736/In-From-the-Cold-Cold-Country-1-by-Mercy-Celeste.pdf
    • http://cefasfese.4pu.com/5733733730731733/The-Cold-Sore-Cure-How-To-Cure-Cold-Sores-And-Prevent-Them-From-Coming-Back-by-Eric-Johnson.pdf
    • http://cefasfese.4pu.com/2735736731736738/Cold-Cold-1-by-Brandon-Shire.pdf
    • http://cefasfese.4pu.com/4734732738737730/Cold-as-Ice-Cold-as-Ice-1-by-Charles-Sheffield.pdf
    • http://cefasfese.4pu.com/3734735736733730/A-Cold-Creek-Baby-Cowboys-of-Cold-Creek-8-by-RaeAnne-Thayne.pdf
    • http://cefasfese.4pu.com/3734735736733731/A-Cold-Creek-Secret-Cowboys-of-Cold-Creek-7-by-RaeAnne-Thayne.pdf
    • http://cefasfese.4pu.com/1731730731731739738/Unterrichtseinheit-zu-problemorientierter-Jugendliteratur-Cold-Turkey---Andys-Zukunftsperspektiven-Ein-Entwurf-zu-quot-Mechtel-Angelika-Cold-Turkey-quot-by-Anonymous.pdf
    • http://cefasfese.4pu.com/4736738733733734/The-Boy-Who-Came-In-From-the-Cold-The-Boy-Who-Came-in-From-the-Cold-1-by-B-G-Thomas.pdf
    • http://cefasfese.4pu.com/3735736731731739/Cold-Stone-Cold

Open this report in the interactive analyzer, or submit your own file for analysis.