Malicious PDF — malware analysis report

Static analysis result for SHA-256 1cf73e4a0e311f79…

MALICIOUS

PDF

19.8 KB Created: 2019-04-30 02:32:19 +01:00 Authoring application: mPDF 5.7
MD5: fd6b3f5e8d1849a1fe9f8efd12a05f41 SHA-1: ccf59e55b54271dbd88c6f73413ae6ef5c297015 SHA-256: 1cf73e4a0e311f79b9c7bd45309a78bcf4ad43a86253fb37733096a4ec9309fe
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded links. The heuristic PDF_SEO_LINK_FARM indicates that these links are likely part of a link farm, potentially for SEO manipulation or to host malicious content. While no scripts were extracted, the sheer volume of links suggests a malicious intent to redirect users or manipulate search engine results. The ML classifier's high confidence score supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9809

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a02a03a03a01a09/Bad-Childhood---Good-Life-How-to-Blossom-and-Thrive-in-Spite-of-an-Unhappy-Childhood-by-Laura-Schlessinger.pdf
    • http://muicuiu.dumb1.com/8a03a07a03a00a04/Constructing-and-Reconstructing-Childhood-Contemporary-Issues-in-the-Sociological-Study-of-Childhood-by-Alan-Prout.pdf
    • http://muicuiu.dumb1.com/2a02a02a08a00a05/Woman-Power-Transform-Your-Man-Your-Marriage-Your-Life-by-Laura-Schlessinger.pdf
    • http://muicuiu.dumb1.com/2a04a05a07a09a06/Still-Life-A-Tunbridge-Wells-Childhood-by-Richard-Cobb.pdf
    • http://muicuiu.dumb1.com/7a00a00a02a04a04/Dancing-With-Daddy-A-Childhood-Lost-and-a-Life-Regained-by-Betsy-Petersen.pdf
    • http://muicuiu.dumb1.com/2a02a02a00a09/Sanctuaries-of-Childhood-Nurturing-a-Child-s-Spiritual-Life-by-Shea-Darian.pdf
    • http://muicuiu.dumb1.com/2a02a02a08a03a08/How-Could-You-Do-That-The-Abdication-of-Character-Courage-and-Conscience-by-Laura-Schlessinger.pdf
    • http://muicuiu.dumb1.com/2a05a09a02a05a02/The-Proper-Care-and-Feeding-of-Marriage-by-Laura-Schlessinger.pdf
    • http://muicuiu.dumb1.com/2a02a02a07a01a01/Stop-Whining-Start-Living-by-Laura-Schlessinger.pdf
    • http://muicuiu.dumb1.com/4a02a01a06a05a09/23-Days-A-short-memoir-of-a-former-police-officer-s-life-from-childhood-dreams-to-his-calling-to-his-last-23-days-that-changed-it-all-by-Ty-Gray.pdf
    • http://muicuiu.dumb1.com/3a00a06a01a09a05/Three-by-Annie-Dillard-Pilgrim-at-Tinker-Creek-An-American-Childhood-The-Writing-Life-by-Annie-Dillard.pdf
    • http://muicuiu.dumb1.com/1a08a00a07a00a05/Childhood-s-End-by-Arthur-C-Clarke.pdf
    • http://muicuiu.dumb1.com/2a08a09a08a01a01/Childhood-s-End-by-Arthur-C-Clarke.pdf
    • http://muicuiu.dumb1.com/8a08a06a07a09a08/First-Childhood-by-Lord-Berners.pdf
    • http://muicuiu.dumb1.com/1a07a05a06a06a07/Childhood-s-End-by-Arthur-C-Clarke.pdf
    • http://muicuiu.dumb1.com/1a01a02a05a00a02a02/Childhood-Days-by-Satyajit-Ray.pdf
    • http://muicuiu.dumb1.com/1a00a07a05a03a03a08/Childhood-s-End-by-Arthur-C-Clarke.pdf
    • http://muicuiu.dumb1.com/1a00a05a04a08a09a04/Boy-Tales-of-Childhood-by-Roald-Dahl.pdf
    • http://muicuiu.dumb1.com/5a03a04a09a06a03/A-Montreal-Childhood-by-Eric-Berne.pdf
    • http://muicuiu.dumb1.com/7a07a09a00a04a03/Childhood-at-Oriol-by-Michael-Burn.pdf
    • http://muicuiu.dumb1.com/2a02a02a08a03a08/How-Could-You-Do-That-The-Abdication-of-Character-Courage-and-Conscience-by-Laura-Schles

Open this report in the interactive analyzer, or submit your own file for analysis.