Malicious PDF — malware analysis report

Static analysis result for SHA-256 0e88651747b3972e…

MALICIOUS

PDF

15.7 KB Created: 2019-04-30 06:46:01 +01:00 Authoring application: mPDF 5.7
MD5: 43601ef3aee65a7d33acfe9ac8562512 SHA-1: 2f235a1cdf157e5e6edda7a00ba6741282635fa4 SHA-256: 0e88651747b3972e8c94a0074514b62e25451b3ca597de2956258b2e4434bd38
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. While the document body is heavily obfuscated, the presence of numerous links to other PDF files suggests a malicious attempt to manipulate search engine results or redirect users to potentially harmful content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a00a01a01a07a00a02/Andersen---The-Illustrated-Fairy-Tales-of-Hans-Christian-Andersen-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/1a08a04a03a04a02/The-Complete-Hans-Christian-Andersen-Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/6a05a09a08a04a06/Hans-Andersen-s-Fairy-Tales-Pictured-by-Mabel-Lucie-Attwell-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/8a05a08a04a03/Fairy-Tales-by-Hans-Andersen-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/2a08a06a09a06a00/The-Classic-Treasury-of-Hans-Christian-Andersen-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/7a02a08a09a07/Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/1a00a08a05a00a06a04/Fairy-Tales-4-Volume-Set-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/5a07a07a04a00a08/The-Complete-Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/5a05a01a04a03a08/The-Little-Mermaid-and-Other-Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/2a03a03a00a05a07/Grimms-Fairy-Tales-and-Andersen-s-Fairy-Tales-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/9a07a01a06a00a05/The-Races-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/3a08a04a09a05a09/The-Fir-Tree-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/8a03a04a02a07/The-Little-Mermaid-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/8a04a05a02a09a01/The-little-match-girl-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/2a05a07a07a01a06/The-Wild-Swans-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/7a00a08a08a05/The-Steadfast-Tin-Soldier-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/6a01a03a07a09a02/The-Little-Match-Girl-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/6a03a03a09a09a08/La-Reine-des-Neiges-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/7a02a04a01a01a03/The-Emperor-s-New-Clothes-by-Hans-Christian-Andersen.pdf
    • http://muicuiu.dumb1.com/1a01a07a08a08a05a03/The-Little-Match-Girl-by-Hans-Christian-Andersen.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.