Malicious PDF — malware analysis report

Static analysis result for SHA-256 20a2f7006cf6ce8a…

MALICIOUS

PDF

16.2 KB Created: 2020-02-15 09:08:04 +00:00 Authoring application: mPDF 5.7
MD5: c8e77fde57a18af15538a33f1999764c SHA-1: d487b476be9c398cd76cebdc8ed0b154e99fc06d SHA-256: 20a2f7006cf6ce8acfcfe438e5c51007b7a5852e37790c1c0fdb644eed5f6750
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded links, such as http://owlaokopdf.myhome.cx/181658163816981648163/Blood-Money-Jane-Whitefield-5-by-Thomas-Perry.pdf, likely serve as a lure to direct users to malicious websites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/181658163816981648163/Blood-Money-Jane-Whitefield-5-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/281628167816681638163/Runner-Jane-Whitefield-6-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/1816181678160816581688167/Perry-Rhodan-2235-Todesspiele-Heftroman-Perry-Rhodan-Zyklus-quot-Der-Sternenozean-quot-Perry-Rhodan-Erstauflage-by-Thomas-Ziegler.pdf
    • http://owlaokopdf.myhome.cx/181618168816781668160/Money-Money-Money-Water-Water-Water-by-Jane-Mead.pdf
    • http://owlaokopdf.myhome.cx/181678168816781608169/Jane-Vows-Vengeance-Jane-Fairfax-3-by-Michael-Thomas-Ford.pdf
    • http://owlaokopdf.myhome.cx/181668166816181658163/Sugar-Money-by-Jane-Harris.pdf
    • http://owlaokopdf.myhome.cx/88169816981648162/Nightlife-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/98160816181658167/Pursuit-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/181628160816381638165/Metzger-s-Dog-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/281658165816781658168/Strip-by-Thomas-Perry.pdf
    • http://owlaokopdf.myhome.cx/181638169816281668163/Someone-Else-s-Money-by-Michael-M-Thomas.pdf
    • http://owlaokopdf.myhome.cx/1816181648168816281698165/Blood-Money-Nolan-2-by-Max-Allan-Collins.pdf
    • http://owlaokopdf.myhome.cx/381688161816581688165/Blood-on-the-Water-William-Monk-20-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.cx/481678168816481668166/An-Other-Kind-of-Fury-A-Call-Of-Blood-1-by-Helena-Perry.pdf
    • http://owlaokopdf.myhome.cx/381628162816881638160/Southampton-Row-Charlotte-amp-Thomas-Pitt-22-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.cx/1816081638169816981678166/The-Money-Deception---What-Banks-amp-Governments-Don-t-Want-You-to-Know-by-Thomas-Herold.pdf
    • http://owlaokopdf.myhome.cx/181678163816881678165/Death-on-Blackheath-Charlotte-amp-Thomas-Pitt-29-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.cx/381628162816881648167/Pentecost-Alley-Charlotte-amp-Thomas-Pitt-16-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.cx/381668162816781628162/Farrier-s-Lane-Charlotte-amp-Thomas-Pitt-13-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.cx/381628162816881638166/Rutland-Place-Charlotte-amp-Thomas-Pitt-5-by-Anne-Perry.pdf
    • http://owlaokopdf.myhome.c

Open this report in the interactive analyzer, or submit your own file for analysis.