Malicious PDF — malware analysis report

Static analysis result for SHA-256 0c4b365edf326681…

MALICIOUS

PDF

15.5 KB Created: 2019-05-02 17:13:40 +01:00 Authoring application: mPDF 5.7
MD5: 42e35c30e7d9d60ffd45c94ede6df367 SHA-1: 3361312d2b50f21ecd4d2cfdb339ee43952d9336 SHA-256: 0c4b365edf326681ed043b2ecac3b7948ca7308d8c81c07ab9aa191f047d9f2f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. While many of these links point to benign-looking book titles, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. No scripts were extracted, and the document body is heavily obfuscated, making a precise determination of the attack difficult.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1200200204204200/Queen-and-Country-Vol-2-Morning-Star-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/5202208209200/Private-Wars-Queen-amp-Country-2-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1202208207208207/A-Gentleman-s-Game-Queen-amp-Country-1-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1200201206206203/Queen-and-Country-Vol-6-Operation-Dandelion-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/7207203204209204/Queen-and-Country-The-Definitive-Edition-Vol-3-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/8209208207202204/Star-Wars-Vor-dem-Erwachen-Die-offizielle-Vorgeschichte-zu-Star-Wars-Das-Erwachen-der-Macht-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1209203204203206/Wonder-Woman-By-Greg-Rucka-Vol-1-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/3207200202208203/The-Morning-Star-In-Which-the-Extraordinary-Correspondence-of-Griffin-amp-Sabine-is-Illuminated-Morning-Star-Trilogy-3-by-Nick-Bantock.pdf
    • http://xiixmcuin.linkpc.net/2202203209/Before-the-Awakening-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/2205200203209203/Whiteout-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/4204204201202208/The-Punisher-Volume-1-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/3204200200206200/Guardians-of-the-Whills-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1209203205208206/The-Question-Pipeline-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/3200207209203201/Batman-No-Man-s-Land-Vol-5-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1200204202209204208/Elektra-Vol-1-Introspect-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/3200207209200206/Batman-No-Man-s-Land-Vol-4-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1209203200207200/Wonder-Woman-The-Hiketeia-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/3200207209200202/Batman-No-Man-s-Land-Vol-3-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/2209201202202201/Lazarus-Vol-1-Family-by-Greg-Rucka.pdf
    • http://xiixmcuin.linkpc.net/1209203206200200/Wonder-Woman-Volume-4-Godwatch-by-Greg-Rucka.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.