Malicious PDF — malware analysis report

Static analysis result for SHA-256 d60e001523da6350…

MALICIOUS

PDF

16.9 KB Created: 2019-05-02 05:12:08 +01:00 Authoring application: mPDF 5.7
MD5: 27ac74fb23062e26044513df6fd10b11 SHA-1: 673fadace2f54aaaafd0ea4a150305320af19d62 SHA-256: d60e001523da6350dd192ba9549d32c3038143bd5589bf8786ae5d29268ef492
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document was flagged by an ML classifier as malicious and contains a large number of embedded links, indicating a potential SEO manipulation or content distribution scheme. The primary heuristic identified a link farm with 23 external PDF links, predominantly hosted on 'cefasfese.4pu.com'. While the individual URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to abuse search engine optimization or distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9731737739737733/Der-Talisman-des-Schattens---Aufruhr-by-Marco-B-rsch.pdf
    • http://cefasfese.4pu.com/1738731737738737/Lover-s-Talisman-Talisman-Bay-1-by-Ashleigh-Raine.pdf
    • http://cefasfese.4pu.com/2732731739731730/The-Onyx-Talisman-Talisman-3-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/4737732731731735/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/1735732734738739/The-Sapphire-Talisman-Talisman-2-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/1736735733736733/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/2731731730737735/The-Emerald-Talisman-Talisman-1-by-Brenda-Pandos.pdf
    • http://cefasfese.4pu.com/7738733733736739/The-Talisman-Chronicles-Boxed-Set-The-Vampire-Diaries-The-Talisman-Chronicles-1-3-by-Mandy-Balde.pdf
    • http://cefasfese.4pu.com/7738733733737733/The-Talisman-Chronicles-Volume-Three-The-Vampire-Diaries-The-Talisman-Chronicles-3-by-Mandy-Balde.pdf
    • http://cefasfese.4pu.com/1730738737730731738/Schattenl-ufer-Gilde-des-Schattens-by-Athina-Dillmann.pdf
    • http://cefasfese.4pu.com/1730738730738736736/MARCO-POLO-M-nchner-Oktoberfest-by-MARCO-POLO-Online-Redaktion.pdf
    • http://cefasfese.4pu.com/9731738739733739/MARCO-POLO-kompakt-Reisef-hrer-Dublin---Sehenswert-MARCO-POLO-Reisef-hrer-E-Book-by-John-Sykes.pdf
    • http://cefasfese.4pu.com/1730739732734735737/The-Talisman-Chronicles-The-Talisman-Chronicles-1-6-by-T-M-Franklin.pdf
    • http://cefasfese.4pu.com/9731737738739733/Aufruhr-in-Terrania-by-Hans-Kneifel.pdf
    • http://cefasfese.4pu.com/9731738730730737/Aufruhr-im-Zahlenland-by-Dr-Alexander-Heimes.pdf
    • http://cefasfese.4pu.com/5731739736736735/Un-anno-in-cucina-con-Marco-Bianchi-by-Marco-Bianchi.pdf
    • http://cefasfese.4pu.com/9731738730731737/Aufruhr-in-mittleren-Jahren-by-Nina-Lykke.pdf
    • http://cefasfese.4pu.com/9731737738739731/The-Tribe-Amber-Herz-in-Aufruhr-by-Linda-Jensen.pdf
    • http://cefasfese.4pu.com/9731738730732732/Geheime-Depeschen-3-Welt-in-Aufruhr-by-Karsten-Sturm.pdf
    • http://cefasfese.4pu.com/9731737738739735/Aufruhr-in-einer-kleinen-Stadt-by-Hans-Hellmut-Kirst.pdf
    • http://cefasfese.4pu.com/7738733733737733/The-

Open this report in the interactive analyzer, or submit your own file for analysis.