Malicious PDF — malware analysis report

Static analysis result for SHA-256 032eee375c8749ee…

MALICIOUS

PDF

42.2 KB Created: 2019-04-30 19:07:27 +01:00 Authoring application: mPDF 5.7
MD5: 2b4f30ee8ec945cbbec858d9fcd84435 SHA-1: bd4c237c5869c74468bb9551d35831cc1a8752ed SHA-256: 032eee375c8749ee2f1a6ff9f64c96b4813862ac35cff245aea4418b832a4ece
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on a dynamic DNS domain. This behavior is indicative of SEO poisoning or a link farm designed to distribute malicious content or redirect users to phishing sites. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9875

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1200203206205205204/Reasoning-with-Uncertainty-in-Robotics-International-Workshop-Rur-95-Amsterdam-the-Netherlands-December-4-6-1995-Proceedings-by-Leo-Dorst.pdf
    • http://xiixmcuin.linkpc.net/5206208206204206/Collected-Papers-Of-Habitat-And-The-High-Rise-Tradition-And-Innovation-Fifth-World-Congress-Amsterdam-The-Netherlands-May-14-19-1995-by-Lynn-S-Beedle.pdf
    • http://xiixmcuin.linkpc.net/8201204203200201/Materials-Manufacturing-Technology-Electronics-and-Information-Science---Proceedings-of-the-2015-International-Workshop-Mmtei2015-Proceedings-of-the-2015-International-Workshop-on-Materials-Manufacturing-Technology-Electronics-and-Information-Scien-by-Xiaolong-Li.pdf
    • http://xiixmcuin.linkpc.net/9206203209209208/Computer-Vision-ECCV-2016-14th-European-Conference-Amsterdam-the-Netherlands-October-11-14-2016-Proceedings-Part-VI-by-Bastian-Leibe.pdf
    • http://xiixmcuin.linkpc.net/6205206202204203/Development-of-the-Agricultural-Machinery-Industry-in-Developing-Countries-Proceedings-of-the-Second-International-Conference-Amsterdam-23-26-Janua-by-A-Moens.pdf
    • http://xiixmcuin.linkpc.net/8201204203200200/Materials-Manufacturing-Technology-Electronics-and-Information-Science---Proceedings-of-the-2015-International-Workshop-Mmtei2015-by-Xiaolong-Li.pdf
    • http://xiixmcuin.linkpc.net/1201204200209206207/Iciam-95-Proceedings-Of-The-Third-International-Congress-On-Industrial-And-Applied-Mathematics-Held-In-Hamburg-Germany-July-3-7-1995-by-Klaus-Kirchgassner.pdf
    • http://xiixmcuin.linkpc.net/9202208209204207/Languages-and-Compilers-for-Parallel-Computing-9th-International-Workshop-Lcpc-96-San-Jose-California-USA-August-8-10-1996-Proceedings-by-David-Sehr.pdf
    • http://xiixmcuin.linkpc.net/7201206206206200/Nonlinear-Dynamics-Chaotic-and-Complex-Systems-Proceedings-of-an-International-Conference-Held-in-Zakopane-Poland-November-7-12-1995-Plenary-Invi-by-E-Infeld.pdf
    • http://xiixmcuin.linkpc.net/6205205201200205/Case-Based-Reasoning-Research-and-Development-22nd-International-Conference-Iccbr-2014-Cork-Ireland-September-29-2014---October-1-2014-Proceedings-by-Luc-Lamontagne.pdf
    • http://xiixmcuin.linkpc.net/9205206208203206/Proceedings-of-the-Third-Un-ESA-NASA-Workshop-on-the-International-Heliophysical-Year-2007-and-Basic-Space-Science-National-Astronomical-Observatory-of-Japan-by-Hans-J-Haubold.pdf
    • http://xiixmcuin.linkpc.net/1200207206209209200/Computer-Algebra-in-Scientific-Computing-16th-International-Workshop-Casc-2014-Warsaw-Poland-September-8-12-2014-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://xiixmcuin.linkpc.net/1200207206209209201/Computer-Algebra-in-Scientific-Computing-18th-International-Workshop-Casc-2016-Bucharest-Romania-September-19-23-2016-Proceedings-by-Vladimir-P-Gerdt.pdf
    • http://xiixmcuin.linkpc.net/7204201202206209/Task-Models-and-Diagrams-for-User-Interface-Design-6th-International-Workshop-TAMODIA-2007-Toulouse-France-November-7-9-2007-Proceedings-by-Marco-Winckler.pdf
    • http://xiixmcuin.linkpc.net/1200207206201202205/Proceedings-Of-The-Sixth-Workshop-On-Algorithm-Engineering-And-Experiments-And-The-First-Workshop-On-Analytic-Algorithmics-And-Combinatorics-by-Lars-Arge.pdf
    • http://xiixmcuin.linkpc.net/8207207205204206/Stochastic-Algorithms-Foundations-And-Applications-International-Symposium-Saga-2001-Berlin-Germany-December-13-14-2001-Proceedings-Lecture-Notes-In-Computer-Science-by-Kathleen-Steinh-fel.pdf
    • http://xiixmcuin.linkpc.net/6202200209201209/KeeKee-s-Big-Adventures-in-Amsterdam-Netherlands-by-Shannon-Jones.pdf
    • http://xiixmcuin.linkpc.net/1200207206209208208/Computer-Algebra-in-Scientific-Computing-18th-International-Workshop-CASC-2016-Bucharest-Romania-September-19-23-2016-Proceedings-Lecture-Notes-in-Computer-Science-by-Vladimir-P-Gerdt.pdf
    • http://xiixmcuin.linkpc.net/9206202209204204/Management-Technologies-for-E-Commerce-and-E-Business-Applications-13th-Ifip-IEEE-International-Workshop-on-Distributed-Systems-Operations-and-Management-Dsom-2002-Montreal-Canada-October-21-23-2002-Proceedings-by-Metin-Feridun.pdf
    • http://xiixmcuin.linkpc.net/6205200200209207/New-Horizons-in-Evolutionary-Robotics-Extended-Contributions-from-the-2009-Evoderob-Workshop-by-Stephane-Doncieux.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.