Malicious PDF — malware analysis report

Static analysis result for SHA-256 d171c5dfbb3d43c0…

MALICIOUS

PDF

18.6 KB Created: 2019-04-30 10:30:07 +01:00 Authoring application: mPDF 5.7
MD5: a44609b31246d64837b8606effc827f3 SHA-1: c6730623f47be6e6bfb2ff1f76b2ccf5669d663a SHA-256: d171c5dfbb3d43c02ae6720d7591516c927a15c7508f695b1cf0ce65aaa25333
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, all hosted on the same domain. This is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted, and the document body was heavily obfuscated, preventing a deeper analysis of the immediate user-facing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9775

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/7735730738732736/Black-Luck-Prof-Croft-5-by-Brad-Magnarella.pdf
    • http://cefasfese.4pu.com/7735730738733731/Book-of-Souls-Prof-Croft-0-5-by-Brad-Magnarella.pdf
    • http://cefasfese.4pu.com/7735730739732732/Love-is-Bleeding-Croft-amp-Croft-Romance-Adventure-4-by-Morgan-Kelley.pdf
    • http://cefasfese.4pu.com/7735730739738737/Hell-is-Burning-Croft-amp-Croft-Romance-Adventure-6-by-Morgan-Kelley.pdf
    • http://cefasfese.4pu.com/3737736731737733/Black-Cat-Crossing-A-Bad-Luck-Cat-Mystery-1-by-Kay-Finch.pdf
    • http://cefasfese.4pu.com/1731736731734737/Full-Black-Scot-Harvath-10-by-Brad-Thor.pdf
    • http://cefasfese.4pu.com/7735730737736731/Ashton-Croft-Confidential-The-Ashton-Croft-Romance-Series-by-Ava-Moore.pdf
    • http://cefasfese.4pu.com/1739738733734730/Luck-of-Love-Luck-1-by-Ashley-Poch.pdf
    • http://cefasfese.4pu.com/4738739732738735/You-Have-Been-Watching---The-Autobiography-Of-David-Croft-by-David-Croft.pdf
    • http://cefasfese.4pu.com/3738732738733735/Panzer-Commander-The-Memoirs-of-Colonel-Hans-von-Luck-by-Hans-von-Luck.pdf
    • http://cefasfese.4pu.com/7735730739733731/Lara-Croft-Tomb-Raider-The-Man-of-Bronze-Lara-Croft-Tomb-Raider-3-by-James-Alan-Gardner.pdf
    • http://cefasfese.4pu.com/1731735733731731732/Gauss-law-for-electrostatics-with-applications-by-Prof-Amit.pdf
    • http://cefasfese.4pu.com/6731730738730736/Prof-Dr-Metin-And-Bibliyografyas-by-Tal-t-Sait-Halman.pdf
    • http://cefasfese.4pu.com/1732735734739/The-Bad-Luck-Wedding-Cake-Bad-Luck-Wedding-2-by-Geralyn-Dawson.pdf
    • http://cefasfese.4pu.com/9733732736736738/Die-Uberwindung-Des-Menschseins-Nach-Der-Heilmethode-Von-Prof-Pilzbarth-by-Jurg-Willi.pdf
    • http://cefasfese.4pu.com/9731738739735738/Handel-in-Theorie-Und-Praxis-Festschrift-Zum-60-Geburtstag-Von-Prof-Dr-Dirk-Mohlenbruch-by-Gesa-Crockford.pdf
    • http://cefasfese.4pu.com/4738732731735732/The-Vintner-s-Luck-The-Vintner-s-Luck-1-by-Elizabeth-Knox.pdf
    • http://cefasfese.4pu.com/9736732739739737/Ueber-Die-Aneurysmen-Der-Hirnarterien-Eine-Abhandlung-in-Briefen-an-Herrn-Geh-Med--Rath-Prof-Dr-Frerichs-in-Berlin-by-Hermann-Lebert.pdf
    • http://cefasfese.4pu.com/1730730737730738732/Paganini-Little-Pagan-The-Life-of-Paganini-in-Verse-by-Prof-Vivienne-M-Suvini-Hand.pdf
    • http://cefasfese.4pu.com/3733732737738732/The-Stranger-Within-by-Kathryn-Croft.pdf
    • http://cefasfese.4pu.com/7735730739733731/Lara-Croft-Tomb-Raider-The-Man-of-

Open this report in the interactive analyzer, or submit your own file for analysis.