Malicious PDF — malware analysis report

Static analysis result for SHA-256 fca93a6a498f19aa…

MALICIOUS

PDF

17.7 KB Created: 2019-08-02 07:36:12 +01:00 Authoring application: mPDF 5.7
MD5: 2ae575c90384fde99c0f7c34e5cb0f13 SHA-1: b1cab1ac62d3ff1c5155c0494beeb0e4b76eab11 SHA-256: fca93a6a498f19aa1243c1ec5a93470b33cf105d27939bbd95f0c8024d26ff62
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, hosted on the domain 'cefasfese.4pu.com'. This behavior is indicative of a link farm or a content-luring scheme, likely intended to drive traffic or potentially serve malicious content disguised as legitimate documents. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9788

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/7737730733737735/Windows-on-the-World-Fifty-Writers-Fifty-Views-by-Matteo-Pericoli.pdf
    • http://cefasfese.4pu.com/1730734738731737731/Samarkand-the-Center-of-the-World-by-Matteo-Compareti.pdf
    • http://cefasfese.4pu.com/4731735733732731/Unfurled-No-More-Forever-by-Michael-L-Eads.pdf
    • http://cefasfese.4pu.com/1736738731736739/Be-Still-My-Soul-A-Banner-is-Unfurled-2-by-Marcie-Gallacher.pdf
    • http://cefasfese.4pu.com/1736738730737735/Abide-With-Me-A-Banner-is-Unfurled-4-by-Marcie-Gallacher.pdf
    • http://cefasfese.4pu.com/7736736732737731/La-Sesta-Colonna-by-Matteo-Interlenghi.pdf
    • http://cefasfese.4pu.com/7737730732739737/Life-in-Five-Seconds-by-Matteo-Civaschi.pdf
    • http://cefasfese.4pu.com/9739739739734738/Batman-Europa-1-by-Matteo-Casali.pdf
    • http://cefasfese.4pu.com/9739739739735737/Batman-Europa-2-by-Matteo-Casali.pdf
    • http://cefasfese.4pu.com/8735731739735735/Denti-guasti-by-De-Simone-Matteo.pdf
    • http://cefasfese.4pu.com/1730733732739737738/Gefl-gelte-Worte-in-5-Sekunden-by-Matteo-Civaschi.pdf
    • http://cefasfese.4pu.com/1737732737735735/The-House-of-the-Scorpion-Matteo-Alacran-1-by-Nancy-Farmer.pdf
    • http://cefasfese.4pu.com/7734733735732738/The-middy-ashore-and-Matteo-Falcone-by-William-Bayle-Bernard.pdf
    • http://cefasfese.4pu.com/7737730733739732/Mission-to-China-Matteo-Ricci-and-the-Jesuit-Encounter-with-the-East-by-Mary-Laven.pdf
    • http://cefasfese.4pu.com/1738737732734731/The-New-World-Order---Whether-It-Is-Attainable-How-It-Can-Be-Attained-and-What-Sort-of-World-a-World-at-Peace-Will-Have-to-Be-by-H-G-Wells.pdf
    • http://cefasfese.4pu.com/1730738730735730/Smart-Girl-stupid-world-Choosing-right-in-a-world-gone-wrong-by-Sarah-Siegand.pdf
    • http://cefasfese.4pu.com/4734737733734731/The-World-s-Columbian-Exposition-The-Chicago-World-s-Fair-of-1893-by-Norman-Bolotin.pdf
    • http://cefasfese.4pu.com/6734736735739732/Six-Months-that-Changed-the-World---The-Treaty-of-Versailles-and-the-Road-to-World-War-II-by-Margaret-MacMillan.pdf
    • http://cefasfese.4pu.com/4731736731732738/Cyber-Warfare-and-the-New-World-Order-World-War-III-Series-4-by-James-Rosone.pdf
    • http://cefasfese.4pu.com/3735735733734738/Window-on-the-World-An-Operation-World-Prayer-Resource-by-Molly-Wall.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.