Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7a9b1268be6663e…

MALICIOUS

PDF

20.1 KB Created: 2019-06-04 10:09:41 +01:00 Authoring application: mPDF 5.7
MD5: 1cbe3edd8b39cab749f5fe391f10b62d SHA-1: 17000a7122a4a9ae72da51b51fa57988a7e7f392 SHA-256: e7a9b1268be6663e356184cc50c4080a21848d8556b79ae3ceb042a2c94eceed
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by an ML classifier as malicious. It contains a large number of embedded URLs, forming a link farm. While the document body is heavily obfuscated, the presence of numerous links to external PDFs suggests a potential attempt to distribute malicious content or manipulate search engine results. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/6732734739737730/Tales-of-California-by-Frank-Oppel.pdf
    • http://cefasfese.4pu.com/6732735730733731/Tales-of-the-West-by-Frank-Oppel.pdf
    • http://cefasfese.4pu.com/6732735730733733/Tales-of-Alaska-and-the-Yukon-by-Frank-Oppel.pdf
    • http://cefasfese.4pu.com/6732735730733732/Tales-Of-The-Canadian-Wilderness-by-Frank-Oppel.pdf
    • http://cefasfese.4pu.com/4731739733733735/Gaslight-amp-Grimm-Steampunk-Faerie-Tales-by-Danielle-Ackley-McPhail.pdf
    • http://cefasfese.4pu.com/1730735730733738/Anne-Frank-s-Tales-from-the-Secret-Annex-A-Collection-of-Her-Short-Stories-Fables-and-Lesser-Known-Writings-Revised-Edition-by-Anne-Frank.pdf
    • http://cefasfese.4pu.com/1738734730737/Where-to-Find-It-Buy-It-Eat-It-in-New-York-by-Gerry-Frank.pdf
    • http://cefasfese.4pu.com/4739734739734730/The-Smoke-New-York-Tales-from-a-Revolution-by-Lars-D-H-Hedbor.pdf
    • http://cefasfese.4pu.com/6739730733734736/Judas-and-Jezabel-The-Tales-of-a-New-York-Nanny-by-C-Y-Brown.pdf
    • http://cefasfese.4pu.com/8734738733738/Pursued-by-the-Rogue-Fairy-Tales-of-New-York-1-by-Kelly-Hunter.pdf
    • http://cefasfese.4pu.com/6739737732731731/The-Second-Human-War-Tales-of-the-Antares-Rangers-5-by-Frank-Calcagno-Jr-.pdf
    • http://cefasfese.4pu.com/6739737732731730/The-Orb-of-Jabbah-Tales-of-the-Antares-Rangers-3-by-Calcagno-Jr-Frank.pdf
    • http://cefasfese.4pu.com/7730735733733734/J-Aime-New-York-2nd-Edition-A-Bilingual-Guide-to-the-French-Heritage-of-New-York-State-Guide-Bilingue-de-l-H-ritage-Fran-ais-de-l-tat-de-New-York-by-Eloise-A-Briere.pdf
    • http://cefasfese.4pu.com/2731736732739735/Isle-of-Palms-Lowcountry-Tales-3-by-Dorothea-Benton-Frank.pdf
    • http://cefasfese.4pu.com/2739730730733739/Pawleys-Island-Lowcountry-Tales-5-by-Dorothea-Benton-Frank.pdf
    • http://cefasfese.4pu.com/2731736734733733/Sullivan-s-Island-Lowcountry-Tales-1-by-Dorothea-Benton-Frank.pdf
    • http://cefasfese.4pu.com/4733730733737/Sullivan-s-Island-Lowcountry-Tales-1-by-Dorothea-Benton-Frank.pdf
    • http://cefasfese.4pu.com/1734732731735730/New-York-Stories-Landmark-Writing-from-Four-Decades-of-New-York-Magazine-by-New-York-Magazine.pdf
    • http://cefasfese.4pu.com/4734735735732732/German-Literary-Fairy-Tales-Johann-Wolfgang-von-Goethe-Clemens-Brentano-Franz-Kafka-and-others-by-Frank-G-Ryder.pdf
    • http://cefasfese.4pu.com/3734730730735733/Star-Wars-Tales-Omnibus-Tales-from-the-Mos-Eisley-Cantina-Tales-of-the-Bounty-Hunters-and-Tales-from-Jabba-s-Palace-by-Kevin-J-Anderson.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.