Malicious PDF — malware analysis report

Static analysis result for SHA-256 dbc4f334df3c76c3…

MALICIOUS

PDF

13.5 KB Created: 2019-05-03 23:19:35 +01:00 Authoring application: mPDF 5.7
MD5: df9c18cd70e2e0dfa87008aa0bdceb39 SHA-1: 7d3c54f045b251fe6b913282b5dd0dcdf42f2a3a SHA-256: dbc4f334df3c76c35cae885963585b32269a8ec7cb1400e620a4378785c82bcf
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1059.001 Command and Scripting Interpreter: PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ML classifier strongly indicated maliciousness. While no scripts were extracted, the PDF structure and link farm suggest a delivery mechanism for further compromise, potentially leading to phishing or malware download. The primary IOCs are the numerous URLs embedded within the document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9773

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/2735738737736730/Two-Nights-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/3730733735737735/Virals-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/5733735/Terminal-Virals-5-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/1739734739739732/Shock-Virals-0-5-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/3730736730738738/Seizure-Virals-2-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2733731735734734/Spike-Virals-5-5-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/4730737735730739/Terminal-Virals-5-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2733738730733732/Bones-Never-Lie-Temperance-Brennan-17-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2739734731733730/D-j-Dead-Temperance-Brennan-1-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2733737737739734/Bones-of-the-Lost-Temperance-Brennan-16-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/1738736737731732/Flash-and-Bones-Temperance-Brennan-14-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/4730739731736/Fatal-Voyage-Temperance-Brennan-4-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/4730734730735/Death-du-Jour-Temperance-Brennan-2-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/1735738733735730/Bones-Are-Forever-Temperance-Brennan-15-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2739736736730739/Fatal-Voyage-Temperance-Brennan-4-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/2739736735733738/Cross-Bones-Temperance-Brennan-8-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/3737737734733/D-j-Dead-Temperance-Brennan-1-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/1733736738733738/Deadly-Decisions-Temperance-Brennan-3-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/3730731732739732/D-j-Dead-Temperance-Brennan-1-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/6733737737735/Monday-Mourning-Temperance-Brennan-7-by-Kathy-Reichs.pdf
    • http://cefasfese.4pu.com/4730

Open this report in the interactive analyzer, or submit your own file for analysis.