Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c99d93723b5b9af…

MALICIOUS

PDF

20.3 KB Created: 2020-03-18 17:44:33 +00:00 Authoring application: mPDF 5.7
MD5: 4585852cabdf09ed283756d69dd6a3d9 SHA-1: 54f7c5dc76fd92b4d21497ac69818c696f43ec92 SHA-256: 1c99d93723b5b9afe0eb181ca17420f8e9d0550bdb38c23840a77b27846e2cd6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, forming a link farm. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a technique to distribute malicious content or engage in SEO abuse. The ML classifier also flagged this PDF as malicious with high confidence. The primary attack pattern involves directing users to a multitude of external PDF files hosted on the domain 'ujcsiniio.myhome.cx'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ujcsiniio.myhome.cx/4cd1cd1cd1cd4cd5/The-Art-of-Chris-Achilleos-Heroes-Angels-amp-Amazons-by-Chris-Achilleos.pdf
    • http://ujcsiniio.myhome.cx/1cd1cd9cd0cd9cd7cd1/109-Forgotten-American-Heroes-by-Chris-Ying.pdf
    • http://ujcsiniio.myhome.cx/8cd6cd0cd3cd6cd0/High-Tide-A-Surf-Odyssey----Photography-by-Chris-Burkhard-by-Chris-Burkard.pdf
    • http://ujcsiniio.myhome.cx/4cd3cd7cd6cd2cd1/Angels-of-Mercy-Foreign-Women-in-the-Anglo-Boer-War-by-Chris-Schoeman.pdf
    • http://ujcsiniio.myhome.cx/9cd8cd2cd8cd2cd9/The-Sweet-Life-with-Chris-Xaver-Companion-to-the-television-show--recipes-from-the-first-2-seasons-by-Chris-Xaver.pdf
    • http://ujcsiniio.myhome.cx/2cd1cd2cd6cd3cd9/Hippolyta-and-the-Curse-of-the-Amazons-Young-Heroes-2-by-Jane-Yolen.pdf
    • http://ujcsiniio.myhome.cx/6cd9cd9cd5cd9cd2/Mystere-Marker-Mysterious-Marker-Pasajes-En-La-Obra-De-Chris-Marker-Passages-in-the-Works-of-Chris-Marker-by-Maria-L-Ortega.pdf
    • http://ujcsiniio.myhome.cx/3cd1cd9cd5cd4cd6/The-Gospel-According-to-Chris-Moyles-The-Story-of-a-Man-and-His-Mouth-by-Chris-Moyles.pdf
    • http://ujcsiniio.myhome.cx/5cd2cd1cd8cd4cd5/Husk-Poems-by-Chris-Price-by-Chris-Price.pdf
    • http://ujcsiniio.myhome.cx/8cd6cd2cd0cd2cd5/Canopy-of-Thunder-Chris-Egharevba-by-Chris-Egharevba.pdf
    • http://ujcsiniio.myhome.cx/4cd0cd7cd1cd3cd6/Angels-are-Real-Angels-Exist-Real-life-encounters-with-Angels-and-Archangels-True-Stories-of-Guardian-Angels-helping-ordinary-people-Angels-are-Real-Angels-Exist-1-by-Tessy-Rawlins.pdf
    • http://ujcsiniio.myhome.cx/4cd9cd2cd1cd7cd4/Corrie-Ten-Boom-Keeper-of-the-Angels-Den-Chrisitan-Heroes-Then-amp-Now-by-Janet-Benge.pdf
    • http://ujcsiniio.myhome.cx/4cd9cd7cd6cd2cd3/Honky-Tonk-Heroes-and-Hillbilly-Angels-The-Pioneers-of-Country-and-Western-Music-by-Holly-George-Warren.pdf
    • http://ujcsiniio.myhome.cx/1cd2cd6cd2cd8cd2/Becoming-by-Chris-Ord.pdf
    • http://ujcsiniio.myhome.cx/2cd9cd0cd6cd0cd4/Going-Down-by-Chris-Campanioni.pdf
    • http://ujcsiniio.myhome.cx/7cd0cd4cd2cd5/Yo-Yes-by-Chris-Raschka.pdf
    • http://ujcsiniio.myhome.cx/4cd5cd5cd3cd7cd0/Now-Let-Me-Tell-You-What-I-Really-Think-by-Chris-Matthews.pdf
    • http://ujcsiniio.myhome.cx/4cd8cd3cd5cd0cd4/Pledged-by-T-M-Chris.pdf
    • http://ujcsiniio.myhome.cx/1cd2cd0cd5cd2cd1/3-DOWN-by-Chris-Grams.pdf
    • http://ujcsiniio.myhome.cx/5cd0cd4cd5cd8cd9/The-Storm-by-Chris-Ord.pdf
    • http://ujcsiniio.myhome.cx/3cd1cd9cd5cd4cd6/The-Gospel-According-to-Chris-Moyl

Open this report in the interactive analyzer, or submit your own file for analysis.