Malicious PDF — malware analysis report

Static analysis result for SHA-256 144e14bb1f468f59…

MALICIOUS

PDF

16.7 KB Created: 2020-03-15 21:19:05 +00:00 Authoring application: mPDF 5.7
MD5: d413752693e9262680c014c7603cfb63 SHA-1: 9baecdcba876c66e50ff8f6289c7bc20ffbddbcd SHA-256: 144e14bb1f468f59ff6ad8024f5179da4d04f5dc89bc7529b7393c85ab7bd885
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files on the domain 'calistazz.myhome.cx'. This is indicative of a link farm or SEO poisoning tactic, designed to drive traffic to potentially malicious or misleading content. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://calistazz.myhome.cx/4869864867862/Stories-1904-1924-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/9865861868869868/Franz-Kafka-Briefe-an-die-Eltern-Aus-den-Jahren-1922---1924-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/7863862861863867/The-Metamorphosis-by-Franz-Kafka-Annotated-and-Translated-Edition-Die-Verwandlung-Franz-Kafka-Collection-Book-1-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/7865861862863863/The-Essential-Kafka-The-Castle-The-Trial-Metamorphosis-and-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/7866862863865864/The-Trial-by-Franz-Kafka-Classic-Annotated-and-Translated-Edition-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/4867865868868861/The-Diaries-of-Franz-Kafka-1910-1913-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/9867861867865/Metamorphosis-and-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/6861865869868868/The-Metamorphosis-and-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/5863864865861866/The-Metamorphosis-and-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/8864862864868861/The-Metamorphosis-And-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/5869860863864865/The-Penal-Colony-and-Other-Stories-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/5862868869867867/Franz-Kafka---Collected-Works-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/8869868862864868/Franz-Kafka---Gesammelte-Werke-Von-quot-Die-Verwandlung-quot-ber-quot-Der-Prozess-quot-bis-hin-zu-quot-Das-Schloss-quot-Illustrierte-Ausgabe-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/4861860865860868/The-Castle-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/6860866866868865/The-Trial-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/1861862861866860860/The-Castle-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/5866861868866864/Metamorphosis-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/5868866866862866/The-Trial-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/6869863865863/The-Castle-by-Franz-Kafka.pdf
    • http://calistazz.myhome.cx/7866862862867861/The-Metamorphosis-by-Franz-Kafka.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.