Malicious PDF — malware analysis report

Static analysis result for SHA-256 2099d6c1452b1c02…

MALICIOUS

PDF

18.3 KB Created: 2019-04-06 20:22:40 +01:00 Authoring application: mPDF 5.7
MD5: bbb32a4dca508cddd72eab5bbd6e2a01 SHA-1: 8490e8ab42c018f8ab2ce27d2a3af1552ac91dd8 SHA-256: 2099d6c1452b1c0261b171b245313f6e877fd598dd66e41467e24795bd000f57
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a link farm. While the document body itself is heavily obfuscated and unreadable, the heuristic 'PDF_SEO_LINK_FARM' indicates a high volume of links, suggesting a malicious intent to redirect users. The ML classifier also flagged this PDF as malicious with high confidence. The primary IOCs are the numerous URLs hosted on 'eiiyersa.linkpc.net'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9754

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eiiyersa.linkpc.ne
    • http://eiiyersa.linkpc.net/1473470475472473/Mojado-Navajo-Nation-Mystery-4-by-R-Allen-Chappell.pdf
    • http://eiiyersa.linkpc.net/2478478471477470/The-Fred-Chappell-Reader-by-Fred-Chappell.pdf
    • http://eiiyersa.linkpc.net/3471477476479475/Stable-Cat-A-Big-Mike-Mystery-3-by-Garrison-Allen.pdf
    • http://eiiyersa.linkpc.net/6472472473474478/Members-of-the-Nation-of-Islam-John-Allen-Muhammad-Snoop-Dogg-Louis-Farrakhan-Benjamin-Chavis-Muhammad-Wallace-Fard-Muhammad-by-Source-Wikipedia.pdf
    • http://eiiyersa.linkpc.net/3477476473478479/Bloom-and-Doom-Bridal-Bouquet-Shop-Mystery-1-by-Beverly-Allen.pdf
    • http://eiiyersa.linkpc.net/9472478477472472/What-is-a-Biblical-Fundamentalist-by-Paul-Chappell.pdf
    • http://eiiyersa.linkpc.net/3475477474479478/A-Whole-World-of-Trouble-by-Helen-Chappell.pdf
    • http://eiiyersa.linkpc.net/7471470477478/Shock-of-Gray-The-Aging-of-the-World-s-Population-and-How-it-Pits-Young-Against-Old-Child-Against-Parent-Worker-Against-Boss-Company-Against-Rival-and-Nation-Against-Nation-by-Ted-C-Fishman.pdf
    • http://eiiyersa.linkpc.net/6476470475477473/Blues-Rock-Riffs-for-Guitar-by-Jon-Chappell.pdf
    • http://eiiyersa.linkpc.net/8471471479479/Farewell-I-m-Bound-to-Leave-You-by-Fred-Chappell.pdf
    • http://eiiyersa.linkpc.net/2476473471473/More-Shapes-Than-One-A-Book-of-Stories-by-Fred-Chappell.pdf
    • http://eiiyersa.linkpc.net/2478477478474477/Look-Back-All-the-Green-Valley-by-Fred-Chappell.pdf
    • http://eiiyersa.linkpc.net/9479473471474/Total-Constant-Order-by-Crissa-Jean-Chappell.pdf
    • http://eiiyersa.linkpc.net/9477476471476477/Navajo-National-Monument-by-Catherine-Viele.pdf
    • http://eiiyersa.linkpc.net/4470474471479477/Navajo-Code-Talkers-by-Andrew-Santella.pdf
    • http://eiiyersa.linkpc.net/8470476470475478/Turquoise-Boy-A-Navajo-Legend-by-Terri-Cohlene.pdf
    • http://eiiyersa.linkpc.net/1474472475471472/Two-Spirits-A-Story-of-Life-with-the-Navajo-by-Walter-L-Williams.pdf
    • http://eiiyersa.linkpc.net/3470473477478472/A-Thief-of-Time-Navajo-Mysteries-8-by-Tony-Hillerman.pdf
    • http://eiiyersa.linkpc.net/3475471470473473/People-of-Darkness-Navajo-Mysteries-4-by-Tony-Hillerman.pdf
    • http://eiiyersa.linkpc.net/8477478477477474/From-the-Glittering-World-A-Navajo-Story-by-Irvin-Morris.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.