Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf88ca7c27668474…

MALICIOUS

PDF

19.0 KB Created: 2019-06-05 03:31:26 +01:00 Authoring application: mPDF 5.7
MD5: 2a306fdd7ca6692c805b75ee09de77a1 SHA-1: 4bdaa2802d16214226d1c35ed2fd965eabc486e0 SHA-256: cf88ca7c27668474d3c1c56a75c87422ae7209f960d50a36aea19539887aad6c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by a machine learning classifier and contains a large number of embedded external links, a technique often used for SEO manipulation or to host malicious content. While the specific URLs extracted were confirmed benign, the sheer volume and structure of the link farm suggest a malicious intent, likely to redirect users to malicious sites or to improve the ranking of malicious content through SEO spam. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2736738736737736/Poems-Introduction-by-Patti-Smith-by-William-Blake.pdf
    • http://cefasfese.4pu.com/4735739739738737/Selected-Poems-of-William-Blake-by-William-Blake.pdf
    • http://cefasfese.4pu.com/1730732738737731739/The-Divine-Comedy-William-Blake-William-Blake-Die-G-ttliche-Kom-die-La-Divine-Com-die-William-Blake-by-David-Bindman.pdf
    • http://cefasfese.4pu.com/1739731738738737/Poems-of-Discovery-by-William-Hart-Smith.pdf
    • http://cefasfese.4pu.com/1731734736735737734/An-inquiry-into-the-nature-and-causes-of-the-wealth-of-nations-by-Adam-Smith-edited-with-an-introduction-notes-marginal-summary-and-an-enlarged-index-by-Edwin-Cannan-with-an-introduction-by-Max-Lerner-by-Adam-Smith.pdf
    • http://cefasfese.4pu.com/2735737735733733/M-Train-by-Patti-Smith.pdf
    • http://cefasfese.4pu.com/2733731733739735/Just-Kids-by-Patti-Smith.pdf
    • http://cefasfese.4pu.com/3733739730733732/M-Train-by-Patti-Smith.pdf
    • http://cefasfese.4pu.com/7737737734737731/Patti-s-Pearls-Lessons-in-Living-Genuinely-Joyfully-Generously-by-Patti-LaBelle.pdf
    • http://cefasfese.4pu.com/9739737738738735/The-Residual-Years-Poems-1934-1948-Including-a-Selection-of-Uncollected-and-Previously-Unpublished-Poems-by-William-Everson.pdf
    • http://cefasfese.4pu.com/5735736739730/Auguries-of-Innocence-by-William-Blake.pdf
    • http://cefasfese.4pu.com/2739732737732735/Songs-of-Experience-by-William-Blake.pdf
    • http://cefasfese.4pu.com/3734734739737/The-Complete-Poetry-and-Prose-by-William-Blake.pdf
    • http://cefasfese.4pu.com/4736738733732732/Songs-of-Innocence-and-of-Experience-by-William-Blake.pdf
    • http://cefasfese.4pu.com/4739739731734730/Jerusalem-The-Emanation-of-the-Giant-Albion-by-William-Blake.pdf
    • http://cefasfese.4pu.com/2731734731734/Eternity-s-Sunrise-The-Imaginative-World-of-William-Blake-by-Leo-Damrosch.pdf
    • http://cefasfese.4pu.com/2735736732731739/An-introduction-to-Aboriginal-societies-by-William-H-Edwards.pdf
    • http://cefasfese.4pu.com/1730732730738739737/Habermas-A-Critical-Introduction-by-William-Outhwaite.pdf
    • http://cefasfese.4pu.com/7735731735734731/Introduction-To-Art-Nouveau-Style-by-William-Hardy.pdf
    • http://cefasfese.4pu.com/7736737732736732/An-Introduction-To-A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.