Malicious PDF — malware analysis report

Static analysis result for SHA-256 c6b0b188501f8130…

MALICIOUS

PDF

16.4 KB Created: 2019-05-03 05:49:33 +01:00 Authoring application: mPDF 5.7 First seen: 2020-12-28
MD5: c5c8306bc0d0d15a5ac0a7ba8c4e86ed SHA-1: ac25664f6505df227575a32aa398783a973b1cff SHA-256: c6b0b188501f8130f769bafb330bf83cb262f9d7310e260dc34f1a16a9dd4266
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links pointing to external PDFs hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a method to distribute malicious content indirectly. The ML classifier also flagged this PDF as malicious, supporting the suspicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1731735732737737736/Plugged-Nickel-by-Robert-Wright-Campbell.pdf In PDF document text
    • http://cefasfese.4pu.com/4733735732732/In-La-La-Land-We-Trust-by-Robert-Wright-Campbell.pdfIn PDF document text
    • http://cefasfese.4pu.com/1737732737737737/Hip-Deep-in-Alligators-by-Robert-Wright-Campbell.pdfIn PDF document text
    • http://cefasfese.4pu.com/1736735732739/The-Junkyard-Dog-Jimmy-Flannery-Mysteries-1-by-Robert-Wright-Campbell.pdfIn PDF document text
    • http://cefasfese.4pu.com/1735730731731733/Beyond-Ultra-by-Robert-A-Wright.pdfIn PDF document text
    • http://cefasfese.4pu.com/2733734735734/The-Evolution-of-God-by-Robert-Wright.pdfIn PDF document text
    • http://cefasfese.4pu.com/2730732733732731/The-Night-Canada-Stood-Still-by-Robert-Wright.pdfIn PDF document text
    • http://cefasfese.4pu.com/1739731736730735/Nonzero-The-Logic-of-Human-Destiny-by-Robert-Wright.pdfIn PDF document text
    • http://cefasfese.4pu.com/1735735738734/The-Chasm-The-Life-And-Death-Of-A-Great-Experiment-In-Ghetto-Education-by-Robert-Campbell.pdfIn PDF document text
    • http://cefasfese.4pu.com/9734737735/Wright-Brothers-Wrong-Story-How-Wilbur-Wright-Solved-the-Problem-of-Manned-Flight-by-William-Hazelgrove.pdfIn PDF document text
    • http://cefasfese.4pu.com/2734732735733737/The-Wright-One-Wright-Love-Duet-2-by-K-A-Linde.pdfIn PDF document text
    • http://cefasfese.4pu.com/5736736739732736/Blow-by-50-Cent.pdfIn PDF document text
    • http://cefasfese.4pu.com/5736737730739732/50-Cent-by-Michael-V-Uschan.pdfIn PDF document text
    • http://cefasfese.4pu.com/1736739730735736/Death-Before-Dishonor-by-50-Cent.pdfIn PDF document text
    • http://cefasfese.4pu.com/5736736739737735/Heaven-s-Fury-by-50-Cent.pdfIn PDF document text
    • http://cefasfese.4pu.com/5736736739737730/Harlem-Heat-by-50-Cent.pdfIn PDF document text
    • http://cefasfese.4pu.com/8735733738739735/Cent-titres-by-Cl-mentine-M-lois.pdfIn PDF document text
    • http://cefasfese.4pu.com/1730736737739732735/Under-the-Western-Sky-Essays-on-the-Fiction-and-Music-of-Willy-Vlautin-Neil-Campbell-Editor-by-Neil-Campbell.pdfIn PDF document text
    • http://cefasfese.4pu.com/5738731735730737/Kings-amp-Queens-of-Cent-Africa-by-Sylviane-A-Diouf.pdfIn PDF document text
    • http://cefasfese.4pu.com/9736732737737732/Cent-millions-pour-Al-Qaida-by-Jean-Fran-ois-Bouchard.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.