Malicious PDF — malware analysis report

Static analysis result for SHA-256 0b2b9f235995febd…

MALICIOUS

PDF

17.5 KB Created: 2019-05-02 05:15:21 +01:00 Authoring application: mPDF 5.7
MD5: 6e00fb8a57bfd671ac3bb7426b8a53e9 SHA-1: 05872f4a49d099b2cfeeeba43c2f472df7912dd4 SHA-256: 0b2b9f235995febdef15c6904e38e5834ab37a2339ea60291e221264676eeaef
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO manipulation tactic. While the document body is heavily obfuscated, the presence of these URLs and the ML classifier's high confidence indicate a malicious intent to redirect users. No scripts were extracted, but the structure implies a malicious document intended to drive traffic to external sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/8209202204203205/Charlie-Brown-s-Cyclopedia-Vol-1-Featuring-Your-Body-by-Funk-amp-Wagnalls.pdf
    • http://xiixmcuin.linkpc.net/8209202205200209/Charlie-Brown-s-Cyclopedia-Featuring-Space-Travel-Vol-7-by-Funk-amp-Wagnalls.pdf
    • http://xiixmcuin.linkpc.net/8209202205200201/Funk-on-Parables-Collected-Essays-by-Robert-W-Funk.pdf
    • http://xiixmcuin.linkpc.net/2201203200205206/The-Children-of-the-Red-King-Books-1-5-Midnight-for-Charlie-Bone-Charlie-Bone-and-the-Time-Twister-Charlie-Bone-and-the-Invisible-Boy-Charlie-Bone-and-the-Castle-of-Mirrors-and-Charlie-Bone-and-the-Hidden-King-by-Jenny-Nimmo.pdf
    • http://xiixmcuin.linkpc.net/2205208204202201/But-We-Love-You-Charlie-Brown-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/6204209206200207/A-Charlie-Brown-Christmas-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/8207201206209206/A-Charlie-Brown-Thanksgiving-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/1201206209203206203/It-s-the-Easter-Beagle-Charlie-Brown-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/1208200206207208/It-s-the-Easter-Beagle-Charlie-Brown-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/2205205205209207/It-s-the-Great-Pumpkin-Charlie-Brown-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/2204202208207200/Let-s-Face-It-Charlie-Brown-Peanuts-Coronet-9-by-Charles-M-Schulz.pdf
    • http://xiixmcuin.linkpc.net/3206209209204/John-Brown-s-Body-by-A-L-Barker.pdf
    • http://xiixmcuin.linkpc.net/2202208207202202/Love-s-Body-by-Norman-O-Brown.pdf
    • http://xiixmcuin.linkpc.net/2203203202209/John-Brown-s-Body-by-Stephen-Vincent-Ben-t.pdf
    • http://xiixmcuin.linkpc.net/2204201207205208/The-Wrecked-Blessed-Body-of-Shelton-LaFleur-by-John-Gregory-Brown.pdf
    • http://xiixmcuin.linkpc.net/2205202208204201/Feed-Me-Writers-Dish-About-Food-Eating-Weight-and-Body-Image-by-Harriet-Brown.pdf
    • http://xiixmcuin.linkpc.net/8209202202208202/Terry-Funk-More-Than-Just-Hardcore-by-Terry-Funk.pdf
    • http://xiixmcuin.linkpc.net/1201203200208200208/Cyclopedia-Anatomicae-by-Gy-rgy-Feh-r.pdf
    • http://xiixmcuin.linkpc.net/6205206204209/Charlie-and-the-Chocolate-Factory-and-Charlie-and-the-Great-Glass-Elevator-by-Roald-Dahl.pdf
    • http://xiixmcuin.linkpc.net/3206203203204/Charlie-and-the-Great-Glass-Elevator-Charlie-Bucket-2-by-Roald-Dahl.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.