Malicious PDF — malware analysis report

Static analysis result for SHA-256 2503c0bdd461d294…

MALICIOUS

PDF

19.0 KB Created: 2019-05-03 07:52:20 +01:00 Authoring application: mPDF 5.7
MD5: 03f1b891f90574e0bb6d2bef65fbac32 SHA-1: 5c4491bf77f314429e49ad17db98b4adff33c1f7 SHA-256: 2503c0bdd461d29496950caa12614a1e596936f11132bd300a007861554db713
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, as indicated by the PDF_SEO_LINK_FARM heuristic. While most of these URLs point to benign content, the sheer volume and the ML_NYX_PDF_MALICIOUS classification suggest a malicious intent, possibly for SEO poisoning or as a distribution vector. The document body is heavily obfuscated, making it difficult to determine the exact payload or lure. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/5a04a01a04a07a05/Village-Diary-Chronicles-of-Fairacre-2-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/4a09a00a07a00a08/Storm-in-the-Village-Chronicles-of-Fairacre-3-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/4a09a00a07a00a06/Village-Centenary-Fairacre-15-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/4a08a08a04a08a07/Summer-at-Fairacre-Fairacre-16-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/1a02a05a01a04a02/Christmas-at-Fairacre-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/3a08a04a02a02a00/Miss-Read-s-Christmas-Tales-Village-Christmas-and-the-Christmas-Mouse-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/2a08a07a05a06a01/Christmas-at-Thrush-Green-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/2a05a01a03a07a04/10-Books-Every-Conservative-Must-Read-Plus-Four-Not-to-Miss-and-One-Impostor-by-Benjamin-Wiker.pdf
    • http://muicuiu.dumb1.com/9a01a02a05a02a01/Dominion-s-Reach-Sergey-Chronicles-3-by-Diann-Thornley-Read.pdf
    • http://muicuiu.dumb1.com/9a01a02a05a01a07/Echoes-of-Issel-Sergey-Chronicles-2-by-Diann-Thornley-Read.pdf
    • http://muicuiu.dumb1.com/8a04a08a05a04a02/ShadowMaster-Chronicles-Book-I-Quest-for-the-World-Love-to-Read-Bonus-Edition-by-Valkyria-DeDieu.pdf
    • http://muicuiu.dumb1.com/2a08a05a04a01a03/Return-to-Thrush-Green-Thrush-Green-5-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/3a08a06a03a05a04/News-from-Thrush-Green-Thrush-Green-3-by-Miss-Read.pdf
    • http://muicuiu.dumb1.com/1a00a01a08a06a07a08/BEN-AARONOVITCH-SERIES-READING-ORDER-A-READ-TO-LIVE-LIVE-TO-READ-CHECKLIST-by-Rita-Bookman.pdf
    • http://muicuiu.dumb1.com/3a09a02a09a06a06/Minecraft-Diaries-Diary-of-a-Wimpy-Ninja-An-Unofficial-Minecraft-Diary-Book-2-The-Noob-Ninja-Chronicles-Book-2-Minecraft-Diaries-Book-by-Minecrafty-Diaries.pdf
    • http://muicuiu.dumb1.com/1a03a02a01a08a00/Miss-Armistead-Makes-Her-Choice-Miss-Delacourt-6-by-Heidi-Ashworth.pdf
    • http://muicuiu.dumb1.com/1a00a06a09a06a02a02/How-Different-From-Us-A-Biography-of-Miss-Buss-and-Miss-Beale-by-Josephine-Kamm.pdf
    • http://muicuiu.dumb1.com/2a05a00a01a08a08/Miss-Radley-s-Third-Dare-Miss-Mayhem-3-by-Heather-Boyd.pdf
    • http://muicuiu.dumb1.com/8a06a03a09a05/Miss-Happiness-and-Miss-Flower-by-Rumer-Godden.pdf
    • http://muicuiu.dumb1.com/4a05a07a09a01a03/Miss-Rivers-And-Miss-Bridges-by-Geraldine-Symons.pdf
    • http://muicuiu.dumb1.com/9a01a02a05a01a07/Echoes

Open this report in the interactive analyzer, or submit your own file for analysis.