Malicious PDF — malware analysis report

Static analysis result for SHA-256 daa5c11f69982268…

MALICIOUS

PDF

20.1 KB Created: 2019-05-02 08:27:04 +01:00 Authoring application: mPDF 5.7
MD5: b6aca68d71b92222559851177e8fa605 SHA-1: 0a21996d28cadae63828f701d32a77c5be849e3c SHA-256: daa5c11f69982268b95818e56aa1eb2bb799227048320301de66812b03f4487a
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ML classifier strongly flagged this PDF as malicious. The primary attack pattern involves directing users to a domain hosting numerous book-themed PDFs, likely as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2737735732734733/Boy-in-the-Twilight-Stories-of-the-Hidden-China-by-Yu-Hua.pdf
    • http://cefasfese.4pu.com/5731736734732737/Imperial-Twilight-The-Opium-War-and-the-End-of-China-s-Last-Golden-Age-by-Stephen-R-Platt.pdf
    • http://cefasfese.4pu.com/3738733733736/The-Good-Women-of-China-Hidden-Voices-by-Xinran.pdf
    • http://cefasfese.4pu.com/4732737735730730/Hidden-Army-Clay-Soldiers-of-Ancient-China-by-Jane-O-39-Connor.pdf
    • http://cefasfese.4pu.com/4738734732737737/China-s-Hidden-Children-Abandonment-Adoption-and-the-Human-Costs-of-the-One-Child-Policy-by-Kay-Ann-Johnson.pdf
    • http://cefasfese.4pu.com/1731732736739736739/China-Where-To-Go-What-To-See---A-China-Travel-Guide-China-Shanghai-Beijing-Xian-Peking-Guilin-Hong-Kong-Book-1-by-Worldwide-Travellers.pdf
    • http://cefasfese.4pu.com/2739738737739730/Twilight-Zone-19-Original-Stories-on-the-50th-Anniversary-by-Carol-Serling.pdf
    • http://cefasfese.4pu.com/2738739731733733/The-Great-Wall-of-China-and-other-Stories-by-Franz-Kafka.pdf
    • http://cefasfese.4pu.com/3732734738734/The-Twilight-Collection-Twilight-1-3-by-Stephenie-Meyer.pdf
    • http://cefasfese.4pu.com/1736738730733731/The-Twilight-Herald-Twilight-Reign-2-by-Tom-Lloyd.pdf
    • http://cefasfese.4pu.com/7735732733738/Twilight-The-Graphic-Novel-Vol-1-The-Twilight-Saga-by-Young-Kim.pdf
    • http://cefasfese.4pu.com/3734737735739/The-Twilight-Saga-Twilight-1-4-by-Stephenie-Meyer.pdf
    • http://cefasfese.4pu.com/1738730737732731/The-Twilight-Saga-Twilight-1-4-by-Stephenie-Meyer.pdf
    • http://cefasfese.4pu.com/2736738734739734/Hidden-Stories-of-the-Childhood-of-Jesus-by-Glenn-Kimball.pdf
    • http://cefasfese.4pu.com/1731734736735737733/Numbers-Do-Lie-61-Hidden-Cricket-Stories-by-Impact-Index.pdf
    • http://cefasfese.4pu.com/1739736737731735/Eight-Dragons-on-the-Roof-and-Other-Tales-Traditional-Dragon-Stories-from-China-by-Haiyan-Chen.pdf
    • http://cefasfese.4pu.com/4731734732737/Hidden-Kitchens-Stories-Recipes-and-More-from-Npr-s-the-Kitchen-Sisters-by-Nikki-Silva.pdf
    • http://cefasfese.4pu.com/4730737731739736/Hidden-Like-Anne-Frank-14-True-Stories-of-Survival-by-Marcel-Prins.pdf
    • http://cefasfese.4pu.com/6730737736730/Twilight-Twilight-1-by-Stephenie-Meyer.pdf
    • http://cefasfese.4pu.com/8731732735732739/Old-Land-New-Tales-Twenty-Short-Stories-by-Writers-of-the-Shaanxi-Region-in-China-by-Chen-Zhongshi.pdf
    • http://cefasfese.4pu.com/1731732736739736739/China-Where-To-Go-What-To-See---A-China-Travel-Guide-China-Shanghai-Beijing-Xian-Peking-Guilin-Hong-Kong-Book-1-by-Wor

Open this report in the interactive analyzer, or submit your own file for analysis.