Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a3ea93975890988…

MALICIOUS

PDF

16.7 KB Created: 2020-03-18 21:25:19 +00:00 Authoring application: mPDF 5.7
MD5: 4789ba564091feaae5e534ad31f80d7f SHA-1: 0e06c483994e149d09041da9b8d0b32163fb20b2 SHA-256: 0a3ea939758909882caae64890ee5ad20939f0cf12b40867e438df1a2f5f4ad9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external websites, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, indicating it is likely a dropper. The embedded URLs are the primary IOCs, suggesting a campaign focused on SEO poisoning or distributing further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9788

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7664505-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7664505-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solosopos.myhome.cx/9850858855858857/Dead-by-Nightfall-Griffin-Powell-13-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1854852858854856/As-Good-As-Dead-Griffin-Powell-4-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/2853850856856855/Dead-by-Midnight-Dead-by-Trilogy-1-Griffin-Powell-11-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/3851859852853854/Killing-Her-Softly-Griffin-Powell-5-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/3859851853851855/Cold-Hearted-Griffin-Powell-9-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/3851855854857857/Nightfall-by-Laura-Griffin.pdf
    • http://solosopos.myhome.cx/1857859853850851/Don-t-Say-A-Word-Don-t-Cry-2-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1854852859851859/What-She-Doesn-t-Know-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1851850856853856854/The-Wanderer-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1854852856852853/Every-Move-She-Makes-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1852859853853/This-Side-of-Heaven-The-Protectors-1-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/1850855855857859853/Blackwood-s-Woman-The-Protectors-6-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/4858858857853855/His-Secret-Child-Silhouette-Desire-1203-3-Babies-For-3-Brothers-1-by-Beverly-Barton.pdf
    • http://solosopos.myhome.cx/2854858852853857/A-New-Game-Next-Move-You-re-Dead-Trilogy-2-by-Linda-L-Barton.pdf
    • http://solosopos.myhome.cx/9850858856858859/By-Nightfall-Nightfall-Series-Book-1-by-Ellen-Waite.pdf
    • http://solosopos.myhome.cx/5853850859856/The-Revelations-of-August-Barton-August-Barton-2-by-Jennifer-LeBlanc.pdf
    • http://solosopos.myhome.cx/1850856853854851859/Griffin-s-Storm-Griffin-3-by-Darby-Karchut.pdf
    • http://solosopos.myhome.cx/8850854855852852/Whyborne-and-Griffin-Books-4-6-Necropolis-Bloodline-and-Hoarfrost-The-Whyborne-amp-Griffin-Series-Box-Sets-Book-2-by-Jordan-L-Hawk.pdf
    • http://solosopos.myhome.cx/4854853854858/Official-Book-Club-Selection-A-Memoir-According-to-Kathy-Griffin-by-Kathy-Griffin.pdf
    • http://solosopos.myhome.cx/4857857853851850/To-Keep-The-Ball-Rolling-The-Memoirs-Of-Anthony-Powell-by-Anthony-Powell.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.