Malicious PDF — malware analysis report

Static analysis result for SHA-256 0402346e20c309ed…

MALICIOUS

PDF

20.2 KB Created: 2020-03-14 00:17:47 +00:00 Authoring application: mPDF 5.7
MD5: 9c837f38c283f456e0ae52b37bf669cc SHA-1: 91e370dfb94844c5752a69b4bca47a144d0385a1 SHA-256: 0402346e20c309edd0d81b74d1c0efefbfba9f0cc4f1eb755a00e6b70796fcd9
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on the domain 'rtuninnsi.myhome.cx'. This pattern is indicative of a link farm or SEO poisoning attempt, designed to drive traffic to malicious or low-quality content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rtuninnsi.myhome.cx/36a96a46a06a56a7/River-Lady-James-River-Trilogy-3-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/36a56a06a56a26a5/Lost-Lady-James-River-Trilogy-2-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/66a06a86a66a36a7/Rivers-of-Norfolk-River-Yare-River-Bure-River-Waveney-River-Nene-River-Ant-River-Thurne-North-Walsham-amp-Dilham-Canal-River-Wensum-by-Source-Wikipedia.pdf
    • http://rtuninnsi.myhome.cx/16a06a76a66a26a36a7/Arge-County-Geography-Introduction-Raul-Doamnei-Raul-Targului-Bratia-River-Bughea-River-Arge-El-River-Valea-Brusturetului-River-by-Source-Wikipedia.pdf
    • http://rtuninnsi.myhome.cx/26a16a16a06a56a9/Sculptured-Anthropoid-Ape-Heads-Found-in-or-Near-the-Valley-of-the-John-Day-River-a-Tributary-of-the-Columbia-River-Oregon-by-James-Terry.pdf
    • http://rtuninnsi.myhome.cx/66a06a36a56a46a8/Fiction-River-Justice-Fiction-River-An-Original-Anthology-Magazine-Book-27-by-Fiction-River.pdf
    • http://rtuninnsi.myhome.cx/66a26a76a76a06a6/Old-Man-River-The-Mississippi-River-in-North-American-History-by-Paul-Schneider.pdf
    • http://rtuninnsi.myhome.cx/96a26a86a76a46a4/Nahanni-River-of-Gold-River-of-Dreams-by-Neil-Hartling.pdf
    • http://rtuninnsi.myhome.cx/26a96a46a76a2/The-Gila-River-The-River-of-the-West-Book-2-by-Gary-McCarthy.pdf
    • http://rtuninnsi.myhome.cx/16a16a56a96a66a0/River-River-Wolfe-1-by-Skyla-Dawn-Cameron.pdf
    • http://rtuninnsi.myhome.cx/36a86a46a66a66a3/River-of-Tomorrow-Wabash-River-3-by-Dorothy-Garlock.pdf
    • http://rtuninnsi.myhome.cx/66a26a66a36a4/Streams-to-the-River-River-to-the-Sea-by-Scott-O-39-Dell.pdf
    • http://rtuninnsi.myhome.cx/16a66a36a76a16a3/Murder-of-a-Sweet-Old-Lady-A-Scumble-River-Mystery-2-by-Denise-Swanson.pdf
    • http://rtuninnsi.myhome.cx/56a06a16a66a66a6/Twin-of-Ice-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/86a16a66a26a9/Just-Curious-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/96a06a66a86a8/Sweetbriar-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/26a16a76a66a86a9/Secrets-by-Jude-Deveraux.pdf
    • http://rtuninnsi.myhome.cx/26a26a26a16a26a2/Green-River-Running-Red-The-Real-Story-of-the-Green-River-Killer--America-s-Deadliest-Serial-Murderer-by-Ann-Rule.pdf
    • http://rtuninnsi.myhome.cx/46a56a76a86a4/Red-River-Vol-1-Red-River-1-by-Chie-Shinohara.pdf
    • http://rtuninnsi.myhome.cx/66a06a46a96a16a8/Red-River-Vol-10-Red-River-10-by-Chie-Shinohara.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.