Malicious PDF — malware analysis report

Static analysis result for SHA-256 e96817935df4ce99…

MALICIOUS

PDF

14.8 KB Created: 2019-06-04 14:37:52 +01:00 Authoring application: mPDF 5.7
MD5: e39a811a4c9cf820b5c3b33d3e801e52 SHA-1: b8c25ead4eb4ae55101766964fd3bdb245878ebb SHA-256: e96817935df4ce99ec5f68b47ecb056e24eadf93719c465e625194e3b1a3b8d2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary function appears to be directing users to a multitude of external websites, likely for SEO spam or to serve as a distribution point for further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/1738737739732735/In-Darkness-Reborn-Paladins-of-Darkness-3-by-Alexis-Morgan.pdf
    • http://cefasfese.4pu.com/1731738730737/Darkness-Unknown-Paladins-of-Darkness-5-by-Alexis-Morgan.pdf
    • http://cefasfese.4pu.com/1735732730734732/Defeat-the-Darkness-Paladins-of-Darkness-6-by-Alexis-Morgan.pdf
    • http://cefasfese.4pu.com/1738731735736732/Dark-Protector-Paladins-of-Darkness-1-by-Alexis-Morgan.pdf
    • http://cefasfese.4pu.com/2739737734735735/Forever-Darkness-The-Black-Rose-3-by-Laura-Morgan.pdf
    • http://cefasfese.4pu.com/5738734739734732/Beautiful-Darkness-Masie-Daughters-of-Highland-Darkness-Book-1-by-Victoria-Zak.pdf
    • http://cefasfese.4pu.com/2732739739734732/The-Edge-of-Darkness-Darkness-Duet-1-by-Melissa-Andrea.pdf
    • http://cefasfese.4pu.com/5734734734739/The-Edge-of-Darkness-Darkness-Duet-1-by-Melissa-Andrea.pdf
    • http://cefasfese.4pu.com/4733735735734732/Darkness-Arising-Cursed-in-Darkness-6-by-Natalie-Hancock.pdf
    • http://cefasfese.4pu.com/4733734737734737/Eternal-Darkness-Cursed-in-Darkness-1-by-Natalie-Hancock.pdf
    • http://cefasfese.4pu.com/4735734733738739/Darkness-Darkness-Charlie-Resnick-12-by-John-Harvey.pdf
    • http://cefasfese.4pu.com/1731737730734737/Darkness-Fades-Darkness-Falls-3-by-Jessica-Sorensen.pdf
    • http://cefasfese.4pu.com/1734735733735736/Blood-Beyond-Darkness-Darkness-4-by-Stacey-Marie-Brown.pdf
    • http://cefasfese.4pu.com/1734738737739737/Beast-in-the-Darkness-Darkness-2-5-by-Stacey-Marie-Brown.pdf
    • http://cefasfese.4pu.com/1731739735736/Touch-of-Darkness-Darkness-Chosen-2-by-Christina-Dodd.pdf
    • http://cefasfese.4pu.com/4735735739731730/Lost-In-His-Darkness-Demons-Of-Darkness-1-by-Elizabeth-Hayes.pdf
    • http://cefasfese.4pu.com/4733737731739/Scent-of-Darkness-Darkness-Chosen-1-by-Christina-Dodd.pdf
    • http://cefasfese.4pu.com/3736735737732736/Of-Death-And-Darkness-Lady-of-Darkness-1-by-Brandy-Slaven.pdf
    • http://cefasfese.4pu.com/4733734739734739/Ascend-from-Darkness-Cursed-in-Darkness-5-by-Natalie-Hancock.pdf
    • http://cefasfese.4pu.com/6738731730739/This-Present-Darkness-Darkness-Set-1-by-Frank-E-Peretti.pdf
    • http://cefasfese.4pu.com/1731737730734737/Darkness-Fades-Darkness-Falls-3-by-Jessica-Sorense

Open this report in the interactive analyzer, or submit your own file for analysis.