Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa32fcbb4093e806…

MALICIOUS

PDF

37.9 KB Created: 2019-11-09 23:22:55 +00:00 Authoring application: mPDF 5.7
MD5: b1724b38e017b1967b0c88134845d86d SHA-1: 3ae021a8669f8a8bdf890496c79348b94216adbc SHA-256: fa32fcbb4093e806cacfb140c23604acb5f26bf552db7c791dd3577b3656c387
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. While the document body is heavily obfuscated, the presence of numerous links suggests a lure to external content. The specific URLs extracted are primarily academic proceedings, but the sheer volume and the heuristic firing suggest a malicious intent, possibly for SEO poisoning or to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9656

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9736738735739736/Learning-Technology-for-Education-in-Cloud-4th-International-Workshop-Ltec-2015-Maribor-Slovenia-August-24-28-2015-Proceedings-by-Lorna-Uden.pdf
    • http://cefasfese.4pu.com/1730737736739738739/Computer-Algebra-in-Scientific-Computing-17th-International-Workshop-Casc-2015-Aachen-Germany-September-14-18-2015-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://cefasfese.4pu.com/8731734733730730/Materials-Manufacturing-Technology-Electronics-and-Information-Science---Proceedings-of-the-2015-International-Workshop-Mmtei2015-by-Xiaolong-Li.pdf
    • http://cefasfese.4pu.com/1730737736739731737/Computer-Algebra-in-Scientific-Computing-14th-International-Workshop-CASC-2012-Maribor-Slovenia-September-3-6-2012-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://cefasfese.4pu.com/7731736736733735/Artificial-Intelligence-and-Soft-Computing-14th-International-Conference-Icaisc-2015-Zakopane-Poland-June-14-18-2015-Proceedings-Part-I-by-Leszek-Rutkowski.pdf
    • http://cefasfese.4pu.com/9730734734736738/Proceedings-of-the-Eighth-International-Symposium-on-Combinatorial-Search-Socs-2015-by-Roni-Stern.pdf
    • http://cefasfese.4pu.com/1731737739736730733/Computer-Vision-Imaging-and-Computer-Graphics-Theory-and-Applications-10th-International-Joint-Conference-Visigrapp-2015-Berlin-Germany-March-11-14-2015-Revised-Selected-Papers-by-Jos-Braz.pdf
    • http://cefasfese.4pu.com/9736738735739738/Advances-in-Databases-and-Information-Systems-Third-East-European-Conference-ADBIS-99-Maribor-Slovenia-September-13-16-1999-Proceedings-Lecture-Notes-in-Computer-Science-by-Johann-Eder.pdf
    • http://cefasfese.4pu.com/9735733733730736/Organization-And-Information-Systems-Proceedings-Of-The-International-Conference-Held-In-Bled-Slovenia-1995-Production-Economics-And-Logistics-Forum-Vol-1-2-by-Zdravko-Kaltnekar.pdf
    • http://cefasfese.4pu.com/1731732736739735734/Energy-and-Environment-Technology-Proceedings-3v-International-Conference-on-Energy-and-Environment-Technology-2009-Guilin-Guangxi-China-by-Institute-of-Electrical-and-Electronics-Engineers.pdf
    • http://cefasfese.4pu.com/1730733736735735734/Reasoning-with-Uncertainty-in-Robotics-International-Workshop-Rur-95-Amsterdam-the-Netherlands-December-4-6-1995-Proceedings-by-Leo-Dorst.pdf
    • http://cefasfese.4pu.com/8735734736730735/Recent-Advances-in-Game-Theory-and-Applications-European-Meeting-on-Game-Theory-Saint-Petersburg-Russia-2015-and-Networking-Games-and-Management-Petrozavodsk-Russia-2015-by-Leon-A-Petrosyan.pdf
    • http://cefasfese.4pu.com/1730737739733739736/Liberating-Learning-Technology-Politics-and-the-Future-of-American-Education-by-Terry-M-Moe.pdf
    • http://cefasfese.4pu.com/1730739731734732731/Looking-Toward-The-Future-Of-Technology-Enhanced-Education-Ubiquitous-Learning-And-The-Digital-Native-by-Martin-Ebner.pdf
    • http://cefasfese.4pu.com/8731734733731734/Computer-Science-Technology-and-Application---Proceedings-of-the-2016-International-Conference-on-Computer-Science-Technology-and-Application-Csta2016-by-Xiaolong-Li.pdf
    • http://cefasfese.4pu.com/8734734737731734/Ant-Algorithms-Third-International-Workshop-Ants-2002-Brussels-Belgium-September-12-14-2002-Proceedings-by-Maroc-Dorigo.pdf
    • http://cefasfese.4pu.com/5731736738734733/Proceedings-of-the-Third-International-Workshop-on-Nude-Mice-Montana-State-University-Bozeman-Montana-September-6-9-1979-by-Norman-D-Reed.pdf
    • http://cefasfese.4pu.com/9732730739732730/Planetary-Nebulae-Proceedings-of-the-180th-Symposium-of-the-International-Astronomical-Union-Held-in-Groningen-the-Netherlands-August-26-30-1996-by-Habing.pdf
    • http://cefasfese.4pu.com/1730737736739730738/Computer-Algebra-in-Scientific-Computing-12th-International-Workshop-CASC-2010-Tsakhkadzor-Armenia-September-6-12-2010-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://cefasfese.4pu.com/1730737736739738733/Computer-Algebra-in-Scientific-Computing-19th-International-Workshop-Casc-2017-Beijing-China-September-18-22-2017-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://cefasfese.4pu.com/8731734733730730/Materials-Manufacturing-Technology-Electronics-and-Information-Science---P

Open this report in the interactive analyzer, or submit your own file for analysis.