Malicious PDF — malware analysis report

Static analysis result for SHA-256 0cb40d7a386dc202…

MALICIOUS

PDF

19.9 KB Created: 2019-05-02 00:42:25 +01:00 Authoring application: mPDF 5.7
MD5: b7879e558e80b21ad0c4a115312055b8 SHA-1: 72f6077ed0030e680fb992770b7a804c63764fda SHA-256: 0cb40d7a386dc202beb8e475fda766950d565462ce44b55e891c8cdfc3c59a76
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. While many of these URLs are marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/1da1da0da5da7da9da8/The-Blizzard-of-78-by-Michael-J-Tougias.pdf
    • http://seasasac.lflinkup.com/2da4da1da5da1da9/A-Storm-Too-Soon-A-True-Story-of-Disaster-Survival-and-an-Incredible-Rescue-by-Michael-J-Tougias.pdf
    • http://seasasac.lflinkup.com/2da6da6da2da0da5/The-Finest-Hours-The-True-Story-of-the-U-S-Coast-Guard-s-Most-Daring-Sea-Rescue-by-Michael-J-Tougias.pdf
    • http://seasasac.lflinkup.com/1da8da5da5da4da0/So-Close-to-Home-A-True-Story-of-an-American-Family-s-Fight-for-Survival-During-World-War-II-by-Michael-J-Tougias.pdf
    • http://seasasac.lflinkup.com/1da0da4da8da0da7da3/Sturm-Blizzard-Blizzard-of-77-Ungluck-Am-Mount-Everest-Schneekatastrophe-in-Norddeutschland-1978-Sturmtief-Daisy-Groundhog-Day-Blizzard-2011-Nor-easter-Ungluck-Von-Eyemouth-Schneesturm-Grosser-Schneesturm-Auge-Schneefegen-by-Quelle-Wikipedia.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da8da0da7/The-Blizzard-by-Jon-Rutherford.pdf
    • http://seasasac.lflinkup.com/2da3da0da5da4/Blizzard-of-One-by-Mark-Strand.pdf
    • http://seasasac.lflinkup.com/4da5da9da2da4da2/The-Blizzard-Voices-by-Ted-Kooser.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da8da2da5/A-Blizzard-of-Passion-by-Gayle-Keo.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da7da4da3/Blizzard-by-Taryn-Kincaid.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da8da0da8/The-Man-in-the-Blizzard-by-Bart-Schneider.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da8da3da1/Reuben-and-the-Blizzard-by-Merle-Good.pdf
    • http://seasasac.lflinkup.com/9da3da0da1da9da0/Caught-The-Blizzard-1-by-Adele-Huxley.pdf
    • http://seasasac.lflinkup.com/7da8da0da5da0da7/The-Blizzard-s-Robe-by-Robert-Sabuda.pdf
    • http://seasasac.lflinkup.com/3da3da1da8da7da4/A-Christmas-Blizzard-by-Garrison-Keillor.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da8da0da9/The-Blizzard-The-Billionaire-s-Bodyguard-2-by-Erin-M-Leaf.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da7da4da9/Overwatch-Anthology-Volume-1-by-Blizzard-Entertainment.pdf
    • http://seasasac.lflinkup.com/1da3da5da6da3/Blizzard-The-Storm-That-Changed-America-by-Jim-Murphy.pdf
    • http://seasasac.lflinkup.com/1da1da0da5da6da9da2/World-of-Warcraft-Chronicle-Volume-1-by-Blizzard-Entertainment.pdf
    • http://seasasac.lflinkup.com/9da2da8da2da2da5/Shadow-Blizzard-Chronicles-of-Siala-3-by-Alexey-Pehov.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.