Malicious PDF — malware analysis report

Static analysis result for SHA-256 174d30d1f5f05e95…

MALICIOUS

PDF

20.0 KB Created: 2019-04-30 05:29:33 +01:00 Authoring application: mPDF 5.7
MD5: 53d15382f37efd5fcf9a7f357800b359 SHA-1: 65b0f995ea9fc21e290201164fe5080775a2db83 SHA-256: 174d30d1f5f05e95b35be836410df4fa699fa9672095acd58b2404dede240c21
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links pointing to external PDF files, many of which are hosted on a dynamic DNS domain. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zacdsa.linkpc.net/5c51c59c50c57c58/La-Frontera-Forests-and-Ecological-Conflict-in-Chile-s-Frontier-Territory-by-Thomas-Miller-Klubock.pdf
    • http://zacdsa.linkpc.net/3c50c55c53c51c56/Territory-Territory-2-by-Susan-A-Bliler.pdf
    • http://zacdsa.linkpc.net/9c59c51c51c50c54/Paul-in-Conflict-with-the-Veil-by-Thomas-Schirrmacher.pdf
    • http://zacdsa.linkpc.net/3c58c54c54c59c50/War-Comes-to-Garmser-Thirty-Years-of-Conflict-on-the-Afghan-Frontier-Carter-Malkasian-by-Carter-Malkasian.pdf
    • http://zacdsa.linkpc.net/1c50c53c51c58c57c59/The-Art-of-War-Spirituality-for-Conflict-Annotated-amp-Explained-by-Thomas-Huynh.pdf
    • http://zacdsa.linkpc.net/5c51c51c52c55c57/Ben-McCulloch-and-the-Frontier-Military-Tradition-by-Thomas-W-Cutrer.pdf
    • http://zacdsa.linkpc.net/6c50c53c52c54c56/T-nel-en-la-frontera-by-Clo-Korman.pdf
    • http://zacdsa.linkpc.net/1c59c54c55c56c52/HAUNTED-ASYLUMS-HAUNTED-CEMETERIES-The-creepiest-places-on-earth-haunted-asylums-haunted-cemeteries-haunted-forests-haunted-woods-True-Tales-of-Haunted-Morgues-Haunted-Forests-Book-1-by-James-Pattern.pdf
    • http://zacdsa.linkpc.net/1c56c58c51c50c59/Final-Frontier-New-Frontier-2-by-Cliff-Ball.pdf
    • http://zacdsa.linkpc.net/1c50c52c52c53c52c57/Multiple-Paths-to-Knowledge-in-International-Relations-Methodology-in-the-Study-of-Conflict-Management-and-Conflict-Resolution-Innovations-in-the-Study-of-World-Politics-by-Zeev-Maoz.pdf
    • http://zacdsa.linkpc.net/3c53c57c57c58c54/Santiago-Do-Chile-by-Martha-Medeiros.pdf
    • http://zacdsa.linkpc.net/1c51c52c50c59c53c53/Chile-amp-Easter-Island-by-Charlotte-Beech.pdf
    • http://zacdsa.linkpc.net/8c51c58c52c50c53/Eastern-Forests-by-Ann-Sutton.pdf
    • http://zacdsa.linkpc.net/1c50c58c58c51c55/Forests-of-Farallon-by-Ben-McKinnon.pdf
    • http://zacdsa.linkpc.net/5c52c56c51c59c58/We-Chile-Personal-Testimonies-of-the-Chilean-Arpilleristas-by-Emma-Sep-lveda.pdf
    • http://zacdsa.linkpc.net/4c59c52c56c53c57/The-Map-and-the-Territory-by-Michel-Houellebecq.pdf
    • http://zacdsa.linkpc.net/5c50c58c53c58c57/New-Territory-by-Larry-Morris.pdf
    • http://zacdsa.linkpc.net/3c58c58c54c52/Unassigned-Territory-by-Kem-Nunn.pdf
    • http://zacdsa.linkpc.net/2c54c55c54c57c50/Uncharted-Territory-by-Jim-Lyon.pdf
    • http://zacdsa.linkpc.net/4c56c50c53c59c52/The-Map-and-the-Territory-by-Michel-Houellebecq.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.