Malicious PDF — malware analysis report

Static analysis result for SHA-256 cb5ceba139dbbb23…

MALICIOUS

PDF

22.1 KB Created: 2019-11-09 23:58:24 +00:00 Authoring application: mPDF 5.7
MD5: e019d7573893a2b264fb16808757f4e9 SHA-1: f140df1b0f59ebbc56f096139dde29810a56cf54 SHA-256: cb5ceba139dbbb2387fc1746a97988bbcd7458f561f75b3970b025f5294d016b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While many of these links point to benign content, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, possibly for SEO spam or to distribute further payloads. No scripts were extracted from this sample, limiting the ability to determine the exact payload delivery mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4734730736738731/Never-Borrow-a-Baronet-Fortune-s-Brides-2-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/6730731733736734/The-Irresistible-Earl-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/8731731739736732/The-Marquis-Kiss-Rogues-and-Rakes-6-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/2730732731738733/The-Rake-s-Redemption-The-Everard-Legacy-3-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/4738737733730733/The-Courting-Campaign-The-Master-Matchmakers-1-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/4738737733730730/Ballrooms-and-Blackmail-The-Lady-Emily-Capers-3-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/6731733738734734/The-Bride-s-Matchmaking-Triplets-Lone-Star-Cowboy-League-Multiple-Blessings-3-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/8739734736734738/Deception-Highland-Brides-of-Skye-Book-3-by-Tarah-Scott.pdf
    • http://cefasfese.4pu.com/3738734736733734/Frontier-Engagement-Frontier-Bachelors-3-by-Regina-Scott.pdf
    • http://cefasfese.4pu.com/2730730735735737/May-We-Borrow-Your-Husband-amp-Other-Comedies-of-the-Sexual-Life-by-Graham-Greene.pdf
    • http://cefasfese.4pu.com/8737733739736735/The-Verner-Raven-The-Count-of-Vendel-s-Daughter-and-Other-Ballads-by-George-Borrow.pdf
    • http://cefasfese.4pu.com/1730737736739733739/Sir-David-Pieter-de-Villiers-Graaff-First-Baronet-of-de-Grendel-by-Ebbe-Dommisse.pdf
    • http://cefasfese.4pu.com/2734739738735737/Fortune-Fortune-2-by-Annabel-Joseph.pdf
    • http://cefasfese.4pu.com/1736739738730733/Fortune-Fortune-2-by-Annabel-Joseph.pdf
    • http://cefasfese.4pu.com/1731738739739730738/Flappers-and-Philosophers-1920-by-Francis-Scott-Fitzgerald-Francis-Scott-Key-Fitzgerald-September-24-1896---December-21-1940-Known-Professionally-as-F-Scott-Fitzgerald-Was-an-American-Novelist-and-Short-Story-Writer-Whose-Works-Illustrate-by-F-Scott-Fitzgerald.pdf
    • http://cefasfese.4pu.com/1731738739739730739/Phineas-Finn-the-Irish-Member-a-Novel-by-Anthony-Trollope-in-Two-Volume-Illustrated-by-Sir-John-Everett-Millais-1st-Baronet-Pra-8-June-1829---13-August-1896-Was-an-English-Painter-and-Illustrator-by-Anthony-Trollope.pdf
    • http://cefasfese.4pu.com/4735735733734734/Puck-Bear-Brides-Complete-Series-Puck-Bear-Brides-1-4-by-Anya-Nowlan.pdf
    • http://cefasfese.4pu.com/2732732737738738/The-Last-Confession-by-Regina-Mhairi.pdf
    • http://cefasfese.4pu.com/4731738737735734/Inheritance-by-Regina-Puckett.pdf
    • http://cefasfese.4pu.com/5730733731732737/The-Gifts-by-Regina-Fackelmayer.pdf
    • http://cefasfese.4pu.com/2730730735735737/May-We-Borrow-Your-Hu