Malicious PDF — malware analysis report

Static analysis result for SHA-256 258f0fa0b169901f…

MALICIOUS

PDF

23.1 KB Created: 2020-03-15 13:20:40 +00:00 Authoring application: mPDF 5.7 First seen: 2021-06-17
MD5: f79d1b1182538a81c14133f5383127ed SHA-1: d0570e2a3f5db1f0505bc16481bd24355722ee83 SHA-256: 258f0fa0b169901f736da2c8ee39849dbae7e8c8d916063b90c95ab16cdd3f0d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were extracted, the presence of numerous links suggests a potential phishing or SEO poisoning attack, aiming to direct users to malicious content. The document body was unreadable, but the heuristic 'SE_DOWNLOAD_BUTTON' suggests a call-to-action, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://peldoaio.myhome.cx/43d13d53d43d43d3/Americans-Bombing-Paris-by-Thomas-Bartlett.pdf In PDF document text
    • http://peldoaio.myhome.cx/13d73d53d83d73d0/Take-Time-for-Paradise-Americans-and-Their-Games-by-A-Bartlett-Giamatti.pdfIn PDF document text
    • http://peldoaio.myhome.cx/23d13d73d43d13d5/The-Greater-Journey-Americans-in-Paris-by-David-McCullough.pdfIn PDF document text
    • http://peldoaio.myhome.cx/23d23d13d03d13d6/The-Greater-Journey-Americans-in-Paris-by-David-McCullough.pdfIn PDF document text
    • http://peldoaio.myhome.cx/73d03d83d23d53d7/The-first-expatriates-Americans-in-Paris-during-the-French-Revolution-by-Yvon-Bizardel.pdfIn PDF document text
    • http://peldoaio.myhome.cx/83d03d13d63d53d5/Cycle-Races-in-France-Tour-de-France-Paris-Brest-Paris-Paris-Roubaix-Paris-Nice-Paris-Brussels-Paris-Tours-Trophee-Des-Grimpeurs-by-Source-Wikipedia.pdfIn PDF document text
    • http://peldoaio.myhome.cx/43d43d53d13d23d1/Paris-Noir-African-Americans-in-the-City-of-Light-by-Tyler-Stovall.pdfIn PDF document text
    • http://peldoaio.myhome.cx/13d03d63d03d53d03d6/Sport-Paris-Fussballverein-Aus-Paris-Sportstatte-in-Paris-Sportveranstaltung-in-Paris-Sportverein-Paris-Olympische-Sommerspiele-1900-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://peldoaio.myhome.cx/93d03d23d93d43d8/Theobald-Wolfe-Tone-by-Thomas-Bartlett.pdfIn PDF document text
    • http://peldoaio.myhome.cx/43d23d23d03d03d2/Pip-Bartlett-s-Guide-to-Unicorn-Training-Pip-Bartlett-2-by-Jackson-Pearce.pdfIn PDF document text
    • http://peldoaio.myhome.cx/33d93d63d63d13d2/Pip-Bartlett-s-Guide-to-Sea-Monsters-Pip-Bartlett-3-by-Jackson-Pearce.pdfIn PDF document text
    • http://peldoaio.myhome.cx/13d03d63d23d63d33d0/Social-Citizenship-for-Whom-Young-Turks-in-Germany-and-Mexican-Americans-in-the-United-States-by-Thomas-Faist.pdfIn PDF document text
    • http://peldoaio.myhome.cx/23d53d73d23d53d1/Hamilton-s-Curse-How-Jefferson-s-Arch-Enemy-Betrayed-the-American-Revolution--and-What-It-Means-for-Americans-Today-by-Thomas-J-DiLorenzo.pdfIn PDF document text
    • http://peldoaio.myhome.cx/73d03d83d73d93d6/Americans-against-liberty-or-An-essay-on-the-nature-and-principles-of-true-freedom-microform-shewing-that-the-designs-and-conduct-of-the-Americans-tend-only-to-tyranny-and-slavery-by-Ambrose-Serle.pdfIn PDF document text
    • http://peldoaio.myhome.cx/63d13d63d73d63d2/Paris-Street-Style-by-Isabelle-Thomas.pdfIn PDF document text
    • http://peldoaio.myhome.cx/23d23d83d13d53d9/Eiffel-s-Tower-and-the-World-s-Fair-where-Buffalo-Bill-Beguiled-Paris-the-Artists-Quarreled-and-Thomas-Edison-Became-a-Count-by-Jill-Jonnes.pdfIn PDF document text
    • http://peldoaio.myhome.cx/13d03d03d93d93d03d7/Bombing-of-Germany-by-Hans-Rumpf.pdfIn PDF document text
    • http://peldoaio.myhome.cx/93d73d03d73d03d9/Bombing-of-Konigsberg-in-World-War-II-by-Jesse-Russell.pdfIn PDF document text
    • http://peldoaio.myhome.cx/13d03d33d53d03d93d6/The-Love-Bombing-of-Lenny-the-Lemming-by-B-F-Moloney.pdfIn PDF document text
    • http://peldoaio.myhome.cx/53d93d33d53d13d7/The-Bombing-of-Hiroshima-and-Nagasaki-by-Valerie-Bodden.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.