Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9c7b6cb777081e3…

MALICIOUS

PDF

17.0 KB Created: 2019-05-02 06:12:07 +01:00 Authoring application: mPDF 5.7
MD5: 11537920f22c31d88fcb32244e3ddfa0 SHA-1: a689e8a91de95d2a6070aa0b3eabd12cf4adaeaf SHA-256: e9c7b6cb777081e3a801a01cde63dfb03f7b076b96ef4d14eba1727866f9f7a5
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ML classifier strongly indicated maliciousness. The primary attack pattern involves a link farm hosted on the domain 'cefasfese.4pu.com'. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/4736736730733733/The-Dark-Enquiry-Lady-Julia-Grey-5-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/4736736730732739/Dark-Road-to-Darjeeling-Lady-Julia-Grey-4-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2736733737735732/Dark-Road-to-Darjeeling-Lady-Julia-Grey-4-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/7730738734738/Twelfth-Night-Lady-Julia-Grey-5-6-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/4736735739731736/Silent-in-the-Grave-Lady-Julia-Grey-1-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2735732736731734/Silent-Night-Lady-Julia-Grey-5-5-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2733735737731730/Silent-in-the-Grave-Lady-Julia-Grey-1-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2736736732737730/Silent-Night-Lady-Julia-Grey-5-5-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/1738736731739730/Silent-in-the-Grave-Lady-Julia-Grey-1-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2733738731731736/Silent-in-the-Grave-Lady-Julia-Grey-1-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2735732734735738/Midsummer-Night-Lady-Julia-Grey-3-5-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/7730733734739738/Deanna-Raybourn-Books-2017-Checklist-Reading-Order-of-A-Spear-of-Summer-Grass-Series-City-of-Jasmine-Series-Lady-Julia-Grey-Series-Veronica-Speedwell-Series-and-List-of-All-Deanna-Raybourn-Books-by-Platinum-List.pdf
    • http://cefasfese.4pu.com/1731737733736/The-Dead-Travel-Fast-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/3733736731732732/Night-of-a-Thousand-Stars-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/1734738733739736/A-Spear-of-Summer-Grass-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/7732735733/A-Treacherous-Curse-Veronica-Speedwell-3-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2732730737734736/Far-in-the-Wilds-A-Spear-of-Summer-Grass-0-5-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/2735730731733730/A-Curious-Beginning-Veronica-Speedwell-1-by-Deanna-Raybourn.pdf
    • http://cefasfese.4pu.com/4734736737736734/The-Lady-Who-Came-in-from-the-Cold-Heart-of-Enquiry-3-by-Grace-Callaway.pdf
    • http://cefasfese.4pu.com/2739732731733730/The-Lady-Most-Willing-Lady-Most-2-by-Julia-Quinn.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.