Malicious PDF — malware analysis report

Static analysis result for SHA-256 d9745eb62036ccb6…

MALICIOUS

PDF

16.9 KB Created: 2019-11-09 22:26:20 +00:00 Authoring application: mPDF 5.7
MD5: 035ee22dfa391e762938377ddadd9cef SHA-1: 8ec632bbb77de90bf0e809b119118ac961b91045 SHA-256: d9745eb62036ccb6ac1f7826766cb77bcfe9d8ccd20beabf6d275fe06c50c4cb
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic identified a link farm with 22 external links. The document body contains numerous URLs, all pointing to PDFs with titles related to the Salem Witch Trials, suggesting a lure to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9788

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1733730739737736/A-Delusion-of-Satan-The-Full-Story-of-the-Salem-Witch-Trials-by-Frances-Hill.pdf
    • http://cefasfese.4pu.com/2739730732735736/Salem-Witch-Trials-by-Michael-Martin.pdf
    • http://cefasfese.4pu.com/4738733733734731/Wicked-Girls-A-Novel-of-the-Salem-Witch-Trials-by-Stephanie-Hemphill.pdf
    • http://cefasfese.4pu.com/7733736733735731/Judge-Sewall-s-Apology-The-Salem-Witch-Trials-and-the-Forming-of-an-American-Conscience-by-Richard-Francis.pdf
    • http://cefasfese.4pu.com/1731730730739739733/Witch-Children-From-Salem-Witch-Hunts-to-Modern-Courtrooms-by-Hans-Sebald.pdf
    • http://cefasfese.4pu.com/5730734733733731/Salem-Witch-Haunt-by-Theresa-Sneed.pdf
    • http://cefasfese.4pu.com/6739736733731731/Tituba-Reluctant-Witch-of-Salem-by-Elaine-G-Breslaw.pdf
    • http://cefasfese.4pu.com/4738735732730734/Dorcas-Good-The-Diary-of-a-Salem-Witch-by-Rose-Earhart.pdf
    • http://cefasfese.4pu.com/8734732732732735/In-the-Shadow-of-Salem-The-Andover-Witch-Hunt-of-1692-by-Richard-Hite.pdf
    • http://cefasfese.4pu.com/1731734736735732/Salem-Witch-Judge-The-Life-and-Repentance-of-Samuel-Sewall-by-Eve-LaPlante.pdf
    • http://cefasfese.4pu.com/2737732738739731/The-Delusion-We-All-Have-Our-Demons-The-Delusion-1-by-Laura-Gallier.pdf
    • http://cefasfese.4pu.com/3734734736730733/Deliverance-from-Evil-by-Frances-Hill.pdf
    • http://cefasfese.4pu.com/8734732732732731/Such-Men-are-Dangerous-The-Fanatics-of-1692-and-2004-by-Frances-Hill.pdf
    • http://cefasfese.4pu.com/4730739730738735/The-King-s-Witch-Frances-Gorges-Trilogy-1-by-Tracy-Borman.pdf
    • http://cefasfese.4pu.com/3735731735735737/The-King-s-Witch-Frances-Gorges-Trilogy-1-by-Tracy-Borman.pdf
    • http://cefasfese.4pu.com/3737737739731739/Full-Moon-Over-Cedar-Hill-by-Edward-Lorn.pdf
    • http://cefasfese.4pu.com/6730731736738731/The-Marquise-Hill-Story-by-Sherry-Hill.pdf
    • http://cefasfese.4pu.com/1739735738733734/Jacob-s-Room-is-Full-of-Books-A-Year-of-Reading-by-Susan-Hill.pdf
    • http://cefasfese.4pu.com/8734732732739730/True-Stories-of-Courage-and-Defiance-from-the-Salem-Witchcraft-Hysteria-of-1692-by-William-Story.pdf
    • http://cefasfese.4pu.com/1730739738734732/The-Witch-of-Primrose-Hill-The-Ramton-Gallow-Mysteries---Book-1-by-C-J-Wright.pdf
    • http://cefasfese.4pu.com/1731734736735732/Salem-Witch-Judge-The-Life-and-Repentance-of-Samuel-Sewal

Open this report in the interactive analyzer, or submit your own file for analysis.