Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f38470790e42e32…

MALICIOUS

PDF

32.1 KB Created: 2019-04-30 04:09:26 +01:00 Authoring application: mPDF 5.7
MD5: 7b4b4f300c34198901f9c6b63bda1893 SHA-1: 6f39b33f2187b04046d6623af7c16122263be37c SHA-256: 1f38470790e42e329914e5277e3150f88ce1311ea69c32ed3f9e0c746acf3021
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDFs hosted on the domain 'muicuiu.dumb1.com'. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a00a03a04a01a03a02/Perry-Rhodan-810-Homo-sapiens-X7-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a02a02a05/Perry-Rhodan-860-R-ckkehr-des-Zeitlosen-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a02a02a06/Perry-Rhodan-861-Gehirntransport-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/9a00a07a04a09a05/Perry-Rhodan-180-Der-gnadenlose-Gegner-Heftroman-Perry-Rhodan-Zyklus-quot-Das-Zweite-Imperium-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a05a09a02a07a03/Perry-Rhodan-1100-Der-Frostrubin-Heftroman-Perry-Rhodan-Zyklus-quot-Die-endlose-Armada-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a07a03a02a09a03/Perry-Rhodan-515-Die-W-chter-der-Einsamkeit-Heftroman-Perry-Rhodan-Zyklus-quot-Der-Schwarm-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a07a03a02a09a00/Perry-Rhodan-525-Das-gro-e-Sterben-Heftroman-Perry-Rhodan-Zyklus-quot-Der-Schwarm-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a08a08a06a08a03/Perry-Rhodan-982-Der-Auserw-hlte-Heftroman-Perry-Rhodan-Zyklus-quot-Die-kosmischen-Burgen-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a05a04a03a09a00/Perry-Rhodan-455-Auf-der-Arenawelt-Heftroman-Perry-Rhodan-Zyklus-quot-Die-Cappins-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a07a03a02a02a06/Perry-Rhodan-510-Die-Ausgesto-enen-Heftroman-Perry-Rhodan-Zyklus-quot-Der-Schwarm-quot-by-William-Voltz.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a01a03a09/Perry-Rhodan-838-Paradies-der-Feuerflieger-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-Kurt-Mahr.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a02a02a07/Perry-Rhodan-821-Die-Gravo-Katastrophe-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-Hans-Kneifel.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a02a03a03/Perry-Rhodan-827-Der-Mann-von-Barkon-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-Clark-Darlton.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a02a03a07/Perry-Rhodan-839-Das-gro-e-Feuerwerk-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-Kurt-Mahr.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a00a02a07/Perry-Rhodan-855-Spektrum-des-Geistes-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-Ernst-Vlcek.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a03a05a08/Perry-Rhodan-807-Der-Kampf-um-Terra-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-H-G-Ewers.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a00a02a00/Perry-Rhodan-835-R-ckkehr-der-Vernunft-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-H-G-Francis.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a03a06a02/Perry-Rhodan-832-Station-der-MVs-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-H-G-Ewers.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a01a03a03/Perry-Rhodan-820-Das-Gravitationsgef-ngnis-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-H-G-Ewers.pdf
    • http://muicuiu.dumb1.com/1a00a03a04a03a05a04/Perry-Rhodan-831-Patrouille-der-MVs-Heftroman-Perry-Rhodan-Zyklus-quot-Bardioc-quot-by-H-G-Ewers.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.