Malicious PDF — malware analysis report

Static analysis result for SHA-256 e8bd5b5333886f72…

MALICIOUS

PDF

14.6 KB Created: 2019-11-09 21:35:53 +00:00 Authoring application: mPDF 5.7
MD5: ac485c0d2475f09c3b2af956bb090b81 SHA-1: 3d1e7284a8a267d96ceeb1c6daab413983a17435 SHA-256: e8bd5b5333886f7288877e8d363f3ddfd6c8809e7cb8b757bcc782b6fa7728d7
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious. The embedded URLs, while currently classified as benign, are part of a link farm hosted on 'cefasfese.4pu.com', suggesting a potential SEO spam or redirection scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4731735738738731/The-Highlander-s-Promise-Highland-Brides-6-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/2737739737733739/The-Highlander-Takes-a-Bride-Highland-Brides-3-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/2730734735739738/To-Marry-a-Scottish-Laird-Highland-Brides-2-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/9736730734735730/St-rmische-N-chte-mit-einem-Highlander-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/3738733736733738/Beyond-the-Highland-Mist-To-Tame-a-Highland-Warrior-Highlander-1-2-by-Karen-Marie-Moning.pdf
    • http://cefasfese.4pu.com/8732737734738/The-Reluctant-Reformer-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/2730737737731738/About-a-Vampire-Argeneau-22-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/8738733737735734/In-den-Armen-des-Ritters-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/1739731739737738/Love-Is-Blind-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/2736730732738731/Sweet-Revenge-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/1737736739731733/Lady-Pirate-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/4730738731734734/About-a-Vampire-Argeneau-22-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/1735732739735735/The-Countess-Madison-Sisters-1-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/1737732735737735/The-Accidental-Vampire-Argeneau-7-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/5731732734732/One-Lucky-Vampire-Argeneau-19-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/3730731731731730/Love-Bites-Argeneau-2-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/4733737733730/Born-to-Bite-Argeneau-13-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/2738739736737731/Born-to-Bite-Argeneau-13-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/3735737730733736/Vampires-Are-Forever-Argeneau-8-by-Lynsay-Sands.pdf
    • http://cefasfese.4pu.com/1738732738730734/A-Quick-Bite-Argeneau-1-by-Lynsay-Sands.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.