Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe97587b0721e3ca…

MALICIOUS

PDF

19.0 KB Created: 2019-05-03 05:25:53 +01:00 Authoring application: mPDF 5.7
MD5: edd6fa897b857f347f0ec25216b7e407 SHA-1: 21703f710afbb5cae8e109a10dd48ba44fcb9266 SHA-256: fe97587b0721e3caa5c91c259e6a6537b5f5ae4808b0c575cc94aa6e68e66b94
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are currently classified as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to act as a lure for further malicious activity. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cefasfese.4pu.com/9730734733734/The-Edge-Chronicles-8-Vox-Second-Book-of-Rook-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/1738734733732736/The-Edge-Chronicles-8-Vox-Second-Book-of-Rook-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/7733731737730/The-Edge-Chronicles-7-The-Last-of-the-Sky-Pirates-First-Book-of-Rook-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/2730739733738739/The-Edge-Chronicles-7-The-Last-of-the-Sky-Pirates-First-Book-of-Rook-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/1738734733736732/The-Edge-Chronicles-9-Freeglader-Third-Book-of-Rook-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/7735736737733/The-Edge-Chronicles-5-Stormchaser-Second-Book-of-Twig-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/2731733735733738/The-Edge-Chronicles-11-The-Nameless-One-First-Book-of-Cade-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/2737739738738739/The-Edge-Chronicles-1-The-Curse-of-the-Gloamgloazer-First-Book-of-Quint-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/4731736732735/The-Edge-Chronicles-6-Midnight-Over-Sanctaphrax-Third-Book-of-Twig-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/1738734733734730/The-Edge-Chronicles-6-Midnight-Over-Sanctaphrax-Third-Book-of-Twig-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/1730733732738736732/The-Edge-Chronicles-Standalone-The-Sky-Chart-A-Book-of-Quint-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/6738731738738/Beyond-the-Deepwoods-The-Edge-Chronicles-The-Twig-Saga-1-The-Edge-Chronicles-4-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/1739736730737737/The-Curse-of-the-Gloamglozer-The-Edge-Chronicles-1-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/4733730732735733/Doombringer-Cade-2-Edge-chronicles-12-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/3738736737739/Beyond-the-Deepwoods-The-Edge-Chronicles-The-Twig-Saga-1-by-Paul-Stewart.pdf
    • http://cefasfese.4pu.com/2736733738735739/Rook-and-Ronin-Complete-Seven-Book-Series-Rook-and-Ronin-Spinoff-1-4-Rook-and-Ronin-1-3-by-J-A-Huss.pdf
    • http://cefasfese.4pu.com/2736737731733738/Edge-Romance-on-the-Edge-Book-1-by-Tiffinie-Helmer.pdf
    • http://cefasfese.4pu.com/8733739730732/Taut-The-Ford-Book-Rook-and-Ronin-Spinoff-by-J-A-Huss.pdf
    • http://cefasfese.4pu.com/2733738730734739/Genius-on-the-Edge-The-Bizarre-Double-Life-of-Dr-William-Stewart-Halsted-by-Gerald-Imber.pdf
    • http://cefasfese.4pu.com/4736732736732738/The-Forest-at-the-Edge-of-the-World-Book-One-Forest-at-the-Edge-series-by-Trish-Mercer.pdf
    • http://cefasfese.4pu.com/4731736732735/The-Edge-Chronicles-6-Midnight-Over-Sanctaphrax-Third-Book-of-Twig-by-Pau

Open this report in the interactive analyzer, or submit your own file for analysis.