Malicious PDF — malware analysis report

Static analysis result for SHA-256 03e9dc468378074b…

MALICIOUS

PDF

16.3 KB Created: 2019-04-30 08:20:29 +01:00 Authoring application: mPDF 5.7 First seen: 2021-06-04
MD5: fd0855f1d93747d091f8950764abda0b SHA-1: 7bdd86cd8307473ad7254648d888046520669213 SHA-256: 03e9dc468378074b6bd7f26122eca541f46b861f6417ab9232b1b0c8f7a58de7
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm, suggesting an attempt to manipulate search engine results or distribute malicious content. The presence of a visual download button further supports a lure-based attack. While no scripts were extracted, the overall structure and heuristic firings indicate a malicious intent to redirect users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a05a01a07a01a04/Running-With-the-Devil-Running-1-by-Lorelei-James.pdf In PDF document text
    • http://muicuiu.dumb1.com/2a05a00a09a02a07/Mindful-Running-How-Meditative-Running-can-Improve-Performance-and-Make-you-a-Happier-More-Fulfilled-Person-by-MacKenzie-L-Havey.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a02a01a00a09a09/Running-with-the-Devil-Plantain-MC-Series-1-by-Amelia-Oliver.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a05a00a08a09a07/Barefoot-Running-Step-by-Step-Barefoot-Ken-Bob-The-Guru-of-Shoeless-Running-Shares-His-Personal-Technique-by-Roy-Wallack.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a04a05a05a07a06/Running-with-the-Firm-by-James-Bannon.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a02a02a03a09a00/Some-Came-Running-The-Definitive-Edition-by-James-Jones.pdfIn PDF document text
    • http://muicuiu.dumb1.com/8a08a03a09a02/Running-Eagle-Woman-Warrior-of-the-Blackfeet-by-James-Willard-Schultz.pdfIn PDF document text
    • http://muicuiu.dumb1.com/5a01a01a01a09a02/Keep-On-Running-by-Ted-Harriott.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a05a00a08a09a06/R-Is-for-Running-by-Ray-Charbonneau.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a03a06a08a01a07/Fox-Running-by-R-R-Knudson.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a04a05a06a05a03/Running-by-H-Carlin.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a09a07a02a01a05/Running-on-Empty-by-S-E-Durrant.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a01a06a03a09a08/Running-Barefoot-by-Amy-Harmon.pdfIn PDF document text
    • http://muicuiu.dumb1.com/6a01a05a01a07a09/Smiley-by-Running-Press.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a07a05a03a09/Running-by-Patrice-Fitzgerald.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a04a09a06a07a08/Running-Barefoot-by-Amy-Harmon.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a01a00a04a05a08/What-Not-to-Say-When-You-re-Running-Away-by-Rachel-John.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a00a05a09a05a02/Running-by-Jean-Echenoz.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a01a08a02a07/RUNNING-IN-CORRIDORS-by-C-H-Edwards.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a07a05a09a04a09/Somewhere-Running-by-Nathalie-Stephens.pdfIn PDF document text