Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ebf391edb9f082c…

MALICIOUS

PDF

14.7 KB Created: 2020-03-18 18:26:45 +00:00 Authoring application: mPDF 5.7
MD5: 6d1bf79c45f2e9422f082c56bfb6d288 SHA-1: 47dae59a4b2f88a3a2295edd3f362d19d2782616 SHA-256: 0ebf391edb9f082c00cc2763c68e1606609acde26f5b136e10db77cf47221fad
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to external resources, suggesting a tactic to manipulate search engine results or redirect users to potentially malicious content. No scripts were extracted from this sample, and the document body was heavily obfuscated.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://weisncio.myhome.cx/6620627628620629/The-Way-Out-is-in-The-Zen-Calligraphy-of-Thich-Nhat-Hanh-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627625624628/The-Art-of-Living-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627628620627/Beyond-the-Self-Teachings-on-the-Middle-Way-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/7626620627620624/El-milagro-de-mindfulness-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/3621621628625622/Each-Breath-a-Smile-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/3629621620621625/No-Death-No-Fear-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6627620621624629/Le-coeur-des-enseignements-du-Bouddha-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627628620628/Inside-the-Now-Meditations-on-Time-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627625625623/Zen-Keys-A-Guide-to-Zen-Practice-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/3629621621628628/Going-Home-Jesus-and-Buddha-as-Brothers-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6625625628629/You-Are-Here-Discovering-the-Magic-of-the-Present-Moment-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627627623623/Thich-Nhat-Hanh-The-Joy-of-Full-Consciousness-by-Rachel-Cartier.pdf
    • http://weisncio.myhome.cx/9625628624626/Peace-of-Mind-Becoming-Fully-Present-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/1620628628625628620/ikari-kokoro-no-honou-no-shizumekata-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/1620621629626627/Anger-Wisdom-for-Cooling-the-Flames-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/1620621626620626625/Jesus-und-Buddha---Ein-Dialog-der-Liebe-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627626626625/Work-How-to-Find-Joy-and-Meaning-in-Each-Hour-of-the-Day-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/6620627627623629/Interbeing-Fourteen-Guidelines-for-Engaged-Buddhism-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/2628627624621626/Peace-Is-Every-Breath-A-Practice-for-Our-Busy-Lives-by-Thich-Nhat-Hanh.pdf
    • http://weisncio.myhome.cx/4625628624623628/Call-Me-by-My-True-Names-The-Collected-Poems-by-Thich-Nhat-Hanh.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.