Malicious PDF — malware analysis report

Static analysis result for SHA-256 27875c103473aa67…

MALICIOUS

PDF

19.6 KB Created: 2020-03-17 04:03:56 +00:00 Authoring application: mPDF 5.7
MD5: 742da691e4a685307af9ab6a2601efd1 SHA-1: d6115ffc518619d2dd7de8d466c17ffe31a1694e SHA-256: 27875c103473aa67d6d221210dd0a4e7c567ccac195b5c406d4e5714e187104d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also strongly flagged this PDF as malicious. The embedded links point to external resources, suggesting a distribution or SEO manipulation tactic. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ewasocmo.myhome.cx/3c33c34c36c30/Gates-of-Fire-An-Epic-Novel-of-the-Battle-of-Thermopylae-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/6c39c32c39c33c33/Do-the-Work-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/7c33c35c37c32/Last-of-the-Amazons-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/2c35c30c33c37c39/Alexander-The-Virtues-of-War-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/6c34c31c37c33/The-Virtues-of-War-A-Novel-of-Alexander-the-Great-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/3c34c33c35c38c39/The-Artist-s-Journey-The-Wake-of-the-Hero-s-Journey-and-the-Lifelong-Pursuit-of-Meaning-by-Steven-Pressfield.pdf
    • http://ewasocmo.myhome.cx/2c37c35c33c31c37/The-War-of-Art-Break-Through-the-Blocks-and-Win-Your-Inner-Creative-Battles-by-Steven-Pressfield-Book-Summary-by-Book-Summaries-by-FlashBooks.pdf
    • http://ewasocmo.myhome.cx/2c36c38c34c39c39/Netflixed-The-Epic-Battle-for-America-s-Eyeballs-by-Gina-Keating.pdf
    • http://ewasocmo.myhome.cx/4c34c31c37c36c35/Deadhouse-Gates-The-Malazan-Book-of-the-Fallen-2-by-Steven-Erikson.pdf
    • http://ewasocmo.myhome.cx/2c35c32c35c35c32/The-Longest-Winter-The-Battle-of-the-Bulge-and-the-Epic-Story-of-World-War-II-s-Most-Decorated-Platoon-by-Alex-Kershaw.pdf
    • http://ewasocmo.myhome.cx/3c31c36c34c34c39/Memory-of-Fire-The-World-Gates-1-by-Holly-Lisle.pdf
    • http://ewasocmo.myhome.cx/9c34c31c30c38c35/Bazooka-Vs-Panzer-Battle-of-the-Bulge-1944-by-Steven-J-Zaloga.pdf
    • http://ewasocmo.myhome.cx/2c35c34c38c30c34/A-Deep-Steady-Thunder-The-Battle-of-Chickamauga-by-Steven-E-Woodworth.pdf
    • http://ewasocmo.myhome.cx/3c38c39c39c37c35/Fire-the-Sky-Contact-The-Battle-for-America-2-by-W-Michael-Gear.pdf
    • http://ewasocmo.myhome.cx/2c35c34c37c39c39/Sabine-Pass-The-Confederacy-s-Thermopylae-by-Edward-T-Cotham-Jr-.pdf
    • http://ewasocmo.myhome.cx/8c32c39c30c35c34/Tom-Gates-Tome-1-C-est-moi-French-version-of-Brilliant-World-of-Tom-Gates-by-Liz-Pichon.pdf
    • http://ewasocmo.myhome.cx/7c37c36c37c35c30/Fountains-of-Fire-Danny-Whitehorse-Jason-Stevens-2-by-Steven-J-Clark.pdf
    • http://ewasocmo.myhome.cx/3c37c31c36c35c34/Patriotic-Fire-Andrew-Jackson-and-Jean-Laffite-at-the-Battle-of-New-Orleans-by-Winston-Groom.pdf
    • http://ewasocmo.myhome.cx/3c37c33c35c32c30/Tom-Gates-is-Absolutely-Fantastic-at-Some-Things-Tom-Gates-5-by-Liz-Pichon.pdf
    • http://ewasocmo.myhome.cx/3c37c33c35c33c32/Tom-Gates-A-tiny-bit-Lucky-Tom-Gates-7-by-Liz-Pichon.pdf
    • http://ewasocmo.myhome.cx/

Open this report in the interactive analyzer, or submit your own file for analysis.