Malicious PDF — malware analysis report

Static analysis result for SHA-256 f4c21c731f6c8004…

MALICIOUS

PDF

17.4 KB Created: 2020-01-03 01:54:14 +00:00 Authoring application: mPDF 5.7
MD5: 307a5e8f803f604a029e3f0dbc9a8da3 SHA-1: 770ea033d7f73788bb30b3eaddcf6426e5b777b0 SHA-256: f4c21c731f6c8004d0b2fede5d32f91d11953d49c2a008c5703db69e266b13e9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a significant number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. While the URLs themselves are currently marked as benign, the sheer volume and structure suggest a link farm designed to direct users to potentially malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/3733739733735733/Exile-Star-Wars-Legacy-of-the-Force-4-by-Aaron-Allston.pdf
    • http://cefasfese.4pu.com/3733739731733734/Betrayal-Star-Wars-Legacy-of-the-Force-1-by-Aaron-Allston.pdf
    • http://cefasfese.4pu.com/6737738730737735/Star-Wars-Legacy-of-the-Force-by-Karen-Traviss.pdf
    • http://cefasfese.4pu.com/3733739731732738/Sacrifice-Star-Wars-Legacy-of-the-Force-5-by-Karen-Traviss.pdf
    • http://cefasfese.4pu.com/3733739733733739/Inferno-Star-Wars-Legacy-of-the-Force-6-by-Troy-Denning.pdf
    • http://cefasfese.4pu.com/3733739733732737/Tempest-Star-Wars-Legacy-of-the-Force-3-by-Troy-Denning.pdf
    • http://cefasfese.4pu.com/3733739737733739/Star-Wars-Vol-3-Rebel-Jail-Star-Wars-3-by-Jason-Aaron.pdf
    • http://cefasfese.4pu.com/5738738733736734/Star-Wars-The-Force-Unleashed-The-Force-Unleashed-1-by-W-Haden-Blackman.pdf
    • http://cefasfese.4pu.com/3734730731730731/Star-Wars-Visionaries-by-Aaron-McBride.pdf
    • http://cefasfese.4pu.com/3733739737732733/Star-Wars-Vader-Down-by-Jason-Aaron.pdf
    • http://cefasfese.4pu.com/3734730730736732/Star-Wars-Omnibus-Vol-1-by-Jason-Aaron.pdf
    • http://cefasfese.4pu.com/2732732731/The-Force-Awakens-Star-Wars-Novelizations-7-by-Alan-Dean-Foster.pdf
    • http://cefasfese.4pu.com/5730735737737730/Star-Wars-The-Force-Awakens-Incredible-Cross-Sections-by-Jason-Fry.pdf
    • http://cefasfese.4pu.com/1739736732732735/Galatea-in-2-D-by-Aaron-Allston.pdf
    • http://cefasfese.4pu.com/1739739736733738/Refugee-Force-Heretic-2-Star-Wars-The-New-Jedi-Order-16-by-Sean-Williams.pdf
    • http://cefasfese.4pu.com/8738735730732/Heirs-of-the-Force-Star-Wars-Young-Jedi-Knights-1-by-Kevin-J-Anderson.pdf
    • http://cefasfese.4pu.com/5735734730730735/1-Voyage-vers-Star-Wars-Le-r-veil-de-la-force---La-cavale-du-contrebandier-by-Greg-Rucka.pdf
    • http://cefasfese.4pu.com/7730735739739733/Cugel-s-Compendium-Of-Indispensable-Advantages-by-Aaron-Allston.pdf
    • http://cefasfese.4pu.com/6736731736738736/Star-Wars-Chevaliers-de-l-ancienne-r-publique-T05-Sans-piti-Star-Wars-Knights-of-the-Old-Republic-6-by-John-Jackson-Miller.pdf
    • http://cefasfese.4pu.com/8739738737732734/Star-Wars-Vor-dem-Erwachen-Die-offizielle-Vorgeschichte-zu-Star-Wars-Das-Erwachen-der-Macht-by-Greg-Rucka.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.