Malicious PDF — malware analysis report

Static analysis result for SHA-256 f6e035b56208cfe6…

MALICIOUS

PDF

18.3 KB Created: 2019-11-07 21:43:23 +00:00 Authoring application: mPDF 5.7
MD5: 97ba2f02c4077741fa818e275de6bc1a SHA-1: 3a631dd98f2c9e8fa6b3df9077a4991cd19a26ef SHA-256: f6e035b56208cfe6c9a319132b693cfc4ddf41dfb9f6ea7bc60a2ab5bce7ea2d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents on a suspicious domain, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this file as malicious. The embedded URLs likely serve as a lure to redirect the user to potentially malicious content or to engage in SEO abuse for malicious purposes. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9775

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/8734738739730732/Brew-Like-a-Monk-Trappist-Abbey-and-Strong-Belgian-Ales-and-How-to-Brew-Them-by-Stan-Hieronymus.pdf
    • http://cefasfese.4pu.com/1730739738735733736/Braddock-5-Stirb-du-zuerst-by-Glenn-Stirling.pdf
    • http://cefasfese.4pu.com/1731732734731736734/Braddock-10-Sarita-die-sch-ne-M-rderin-by-U-H-Wilken.pdf
    • http://cefasfese.4pu.com/6732731738732/A-Seductive-Flame-Braddock-Black-2-by-Susan-Johnson.pdf
    • http://cefasfese.4pu.com/3737733735739735/Stinky-Cecil-in-Operation-Pond-Rescue-by-Paige-Braddock.pdf
    • http://cefasfese.4pu.com/1730738735730736736/Like-a-Witch-s-Brew-by-R-P-Christman.pdf
    • http://cefasfese.4pu.com/4731731733731739/The-Devil-s-Brew-Sinners-2-5-by-Rhys-Ford.pdf
    • http://cefasfese.4pu.com/1730738736739734/Brew-Salem-s-Revenge-1-by-David-Estes.pdf
    • http://cefasfese.4pu.com/1734731738737737/Cinderella-Man-James-Braddock-Max-Baer-and-the-Greatest-Upset-in-Boxing-History-by-Jeremy-Schaap.pdf
    • http://cefasfese.4pu.com/4735732738733734/Hush-Moving-From-Silence-to-Healing-After-Childhood-Sexual-Abuse-by-Nicole-Braddock-Bromley.pdf
    • http://cefasfese.4pu.com/2734734736736737/Strange-Brew-Bone-Chillers-5-by-Betsy-Haynes.pdf
    • http://cefasfese.4pu.com/3732737735731731/The-Witchlets-of-Witches-Brew-A-Collection-of-Tales-by-Edain-Duguay.pdf
    • http://cefasfese.4pu.com/9736731731732735/Goodnight-Brew-A-Parody-for-Beer-People-by-Karla-Oceanak.pdf
    • http://cefasfese.4pu.com/4739731739730734/Dead-Cold-Brew-Coffeehouse-Mystery-16-by-Cleo-Coyle.pdf
    • http://cefasfese.4pu.com/9736731731731739/Good-Morning-Brew-A-Parody-for-Coffee-People-by-Karla-Oceanak.pdf
    • http://cefasfese.4pu.com/3738734738739736/Bill-Mauldin-s-Army-Bill-Mauldin-s-Greatest-World-War-II-Cartoons-by-Bill-Mauldin.pdf
    • http://cefasfese.4pu.com/8739733733732730/Bitter-Brew-The-Rise-and-Fall-of-Anheuser-Busch-and-America-s-Kings-of-Beer-by-William-Knoedelseder.pdf
    • http://cefasfese.4pu.com/9739730733738/Bill-the-Vampire-The-Tome-of-Bill-1-by-Rick-Gualtieri.pdf
    • http://cefasfese.4pu.com/5739731731732739/Boule-et-Bill---Le-roi-de-la-jungle-Biblio-Mango-Boule-et-Bill-by-d-39-apr-s-Roba.pdf
    • http://cefasfese.4pu.com/6730735737731733/Album-No-7-Des-gags-de-Boule-et-Bill-Boule-et-Bill-7-by-Jean-Roba.pdf
    • http://cefasfese.4pu.com/47357327

Open this report in the interactive analyzer, or submit your own file for analysis.