Malicious PDF — malware analysis report

Static analysis result for SHA-256 0bd16c28da77f6cd…

MALICIOUS

PDF

17.3 KB Created: 2020-03-16 04:14:41 +00:00 Authoring application: mPDF 5.7
MD5: 8d3914b6cd8a41d5db66ab04296c7e6e SHA-1: a4605b7e25d9948e18b4fa920bd5e9f5376b4a99 SHA-256: 0bd16c28da77f6cd95c66fda3f59d8e0bcd779c8e2dee35f1c5579601eb7c866
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to a single domain, structured as a link farm. This heuristic, combined with the ML classifier, indicates a malicious intent to redirect users to potentially harmful content. The embedded URLs are likely intended to be clicked, leading to the download of further malicious files or engagement with a phishing scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/7559551553554555/The-Mysterious-Affair-at-Styles-by-Agatha-Christie-Annotated-James-Lynn-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/8550556557559550/Agatha-Christie---The-Mysterious-Affair-at-Styles-quot-If-You-Place-Your-Head-in-a-Lion-s-Mouth-Then-You-Cannot-Complain-One-Day-If-He-Happens-to-Bite-It-Off-quot-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3557554550555555/Agatha-The-Real-Life-of-Agatha-Christie-by-Anne-Martinetti.pdf
    • http://ieuicufioao.myhome.cx/2557550558553/The-Complete-Christie-An-Agatha-Christie-Encyclopedia-by-Matthew-Bunson.pdf
    • http://ieuicufioao.myhome.cx/3558558555552552/Christie-Classics-The-murder-of-Roger-Ackroyd-And-then-there-were-none-The-witness-for-the-prosecution-Philomel-Cottage-Three-blind-mice-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3552552550551/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/1550551559555554553/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/5552551556554/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/5555554556559554/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/4550559557550550/N-or-M-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/4558555551556553/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/5553551553552/And-Then-There-Were-None-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/2552553552555557/Evil-Under-the-Sun-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/4553559556552559/Evil-Under-the-Sun-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/4555556552558556/Sad-Cypress-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3556555559558554/They-Came-to-Baghdad-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3552555552550558/Death-Comes-as-the-End-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3556557557557554/There-is-a-Tide-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3551559556553555/Tod-in-den-Wolken-by-Agatha-Christie.pdf
    • http://ieuicufioao.myhome.cx/3557556550554559/There-is-a-Tide-by-Agatha-Christie.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.