Malicious PDF — malware analysis report

Static analysis result for SHA-256 0629633d59ae0679…

MALICIOUS

PDF

13.3 KB Created: 2019-05-02 01:19:32 +01:00 Authoring application: mPDF 5.7
MD5: 47f99ab7e511b66968c6372e590b1978 SHA-1: 365358ec4c4c11316ae8db06bb232adc953e730c SHA-256: 0629633d59ae06791547562747d9311e3cb60eed73e3311c5d6a723613ab121f
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, identified as a link farm. While the document body is heavily obfuscated, the presence of numerous URLs and the 'PDF_SEO_LINK_FARM' heuristic indicate a likely attempt to manipulate search engine results or redirect users to potentially malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/8a06a05a09a06/Dead-Man-s-Song-Pine-Deep-2-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a07a05a02a03/Ghost-Road-Blues-Pine-Deep-1-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a00a06a01a02a05/Ghost-Road-Blues-Pine-Deep-Trilogy-1-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/1a05a03a03a06a03/Deep-Dark-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/6a01a07a04a03/Dead-of-Night-Dead-of-Night-1-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/8a00a03a07a05a07/Zombie-CSU-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a05a09a06a04a09/Limbus-Inc-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/2a01a07a07a03a07/Countdown-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/4a08a03a04a07a04/Countdown-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/2a01a08a08a09a02/V-Wars-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/1a07a04a08a04a03/Code-Zero-Joe-Ledger-6-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a08a08a00a07/Patient-Zero-Joe-Ledger-1-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/2a08a05a07a08a04/Predator-One-Joe-Ledger-7-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/1a01a09a03a06a00/Extinction-Machine-Joe-Ledger-5-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/9a07a09a02/Kill-Switch-Joe-Ledger-8-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a04a00a06a07a05/Dead-Speak-Cold-Case-Psychic-1-by-Pandora-Pine.pdf
    • http://muicuiu.dumb1.com/2a02a09a08a09a08/V-Wars-A-Chronicle-of-the-Vampire-Wars-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/3a04a01a03a08/Rot-amp-Ruin-Rot-amp-Ruin-1-by-Jonathan-Maberry.pdf
    • http://muicuiu.dumb1.com/2a06a06a07a09a01/The-Diamond-Deep-Ruby-s-Song-2-by-Brenda-Cooper.pdf
    • http://muicuiu.dumb1.com/9a08a04a08a05a06/The-Song-of-Panne-by-Jonathan-Downes.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.