Malicious PDF — malware analysis report

Static analysis result for SHA-256 09a0587050978182…

MALICIOUS

PDF

15.1 KB Created: 2019-04-29 22:47:56 +01:00 Authoring application: mPDF 5.7
MD5: 2abc25be05a8ab13723f0596dbfd1ff9 SHA-1: 4578ea679c66e64afbdbf7d8a18e7755c35ea14a SHA-256: 09a05870509781828aa01409dea00efe9cf0d5166abe4b57cfe01b4b62ec5dd8
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various book titles hosted on the same domain, suggesting a potential SEO spam or content farm operation. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9891

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/3204205201202203/Dreams-and-Shadows-by-C-Robert-Cargill.pdf
    • http://xiixmcuin.linkpc.net/3208205201204201/Dreams-and-Shadows-Dreams-amp-Shadows-1-by-C-Robert-Cargill.pdf
    • http://xiixmcuin.linkpc.net/2202207204206203/Sea-of-Rust-by-C-Robert-Cargill.pdf
    • http://xiixmcuin.linkpc.net/6204206204/Sea-of-Rust-by-C-Robert-Cargill.pdf
    • http://xiixmcuin.linkpc.net/3202207200206202/We-Are-Where-the-Nightmares-Go-and-Other-Stories-by-C-Robert-Cargill.pdf
    • http://xiixmcuin.linkpc.net/1209204209201202/Dreams-and-Shadows-The-Aylosian-Chronicles-1-by-Jeffrey-Collyer.pdf
    • http://xiixmcuin.linkpc.net/2200200208207203/Shadows-amp-Dreams-Kate-Kane-Paranormal-Investigator-2-by-Alexis-Hall.pdf
    • http://xiixmcuin.linkpc.net/2209200202201200/The-Best-of-Robert-E-Howard-Crimson-Shadows-Volume-1-by-Robert-E-Howard.pdf
    • http://xiixmcuin.linkpc.net/1202200202205205/Eve-Hallows-and-the-Book-of-Shadows-The-Nightmare-Series-2-by-Robert-Gray.pdf
    • http://xiixmcuin.linkpc.net/3207207204206204/Knife-of-Dreams-Wheel-of-Time-11-by-Robert-Jordan.pdf
    • http://xiixmcuin.linkpc.net/9206203202208208/The-Dreams-of-Morpheus-Crossroads-Brotherhood-2-by-Robert-Fabbri.pdf
    • http://xiixmcuin.linkpc.net/2208205204206206/Knife-of-Dreams-Wheel-of-Time-11-by-Robert-Jordan.pdf
    • http://xiixmcuin.linkpc.net/6207207203202203/Hollywood-Monster-A-Walk-Down-Elm-Street-with-the-Man-of-Your-Dreams-by-Robert-Englund.pdf
    • http://xiixmcuin.linkpc.net/3208205204208207/The-Coming-Anarchy-Shattering-the-Dreams-of-the-Post-Cold-War-by-Robert-D-Kaplan.pdf
    • http://xiixmcuin.linkpc.net/8204205201207208/Knife-of-Dreams-The-Wheel-of-Time-Book-11-Publisher-Tor-Fantasy-by-Robert-Jordan.pdf
    • http://xiixmcuin.linkpc.net/9209208203208205/The-Surfer-by-Linda-Cargill.pdf
    • http://xiixmcuin.linkpc.net/3209202201207207/The-Dark-by-Linda-Cargill.pdf
    • http://xiixmcuin.linkpc.net/3205203209208205/Underneath-by-Michael-Cargill.pdf
    • http://xiixmcuin.linkpc.net/9209208203208202/Take-Two-Waiting-for-Callback-2-by-Perdita-Cargill.pdf
    • http://xiixmcuin.linkpc.net/9209208203207206/Cargill-From-Commodities-to-Customers-by-Wayne-G-Broehl-Jr-.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.