Malicious PDF — malware analysis report

Static analysis result for SHA-256 28aceeca23c5eb9e…

MALICIOUS

PDF

13.8 KB Created: 2019-04-25 00:48:08 +01:00 Authoring application: mPDF 5.7 First seen: 2021-06-28
MD5: ffd247a52a02a02e1880291b9bffe309 SHA-1: 021364ad6f264e33f85eb625ea315f4a79c53e5e SHA-256: 28aceeca23c5eb9e05efc0aafb6218cb53aab8f88d746a366ea42850e848b76c
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. While the document body is unreadable, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests a malicious intent to redirect users to numerous other PDF documents. The ML classifier also flagged this PDF as malicious. No scripts were extracted, but the presence of many links implies a potential for further malicious redirection or content delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/3a04a03a06a05a07/Anyone-for-Seconds-by-Fiona-Cassidy.pdf In PDF document text
    • http://muicuiu.dumb1.com/5a00a05a09a03/Cassidy-Jones-and-the-Secret-Formula-Cassidy-Jones-Adventures-1-by-Elise-Stokes.pdfIn PDF document text
    • http://muicuiu.dumb1.com/6a08a07a02a04a07/Off-The-Beaten-Path---A-Steve-Cassidy-Mystery-Steve-Cassidy-3-by-John-Schlarbaum.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a09a00a06a03a08/Cassidy-Jones-and-the-Secret-Formula-Cassidy-Jones-Adventures-1-by-Elise-Stokes.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a09a00a06a03a09/Cassidy-Jones-and-Vulcan-s-Gift-Cassidy-Jones-Adventures-2-by-Elise-Stokes.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a03a02a09a00a01/Cassidy-Jones-and-the-Luminous-Cassidy-Jones-Adventures-4-by-Elise-Stokes.pdfIn PDF document text
    • http://muicuiu.dumb1.com/6a00a08a04a00a03/The-Cathy-Cassidy-Dreams-and-Doodles-Daybook-by-Cathy-Cassidy.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a08a08a08a05a02/Naked-and-Sexual-Fiona-Thrust-1-by-Fiona-Thrust.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a03a03a08a00a04/30-Seconds-by-Chrys-Fey.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a00a01a05a05/180-Seconds-by-Jessica-Park.pdfIn PDF document text
    • http://muicuiu.dumb1.com/5a05a08a05a02a03/180-Seconds-by-Jessica-Park.pdfIn PDF document text
    • http://muicuiu.dumb1.com/2a01a08a04a01a09/Six-Seconds-of-Moonlight-by-James-Coughtrey.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a04a06a03a05a07/Sloppy-Seconds-by-Piper-Scott.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a09a06a08a05a03/Sinful-Seconds-by-Elisabeth-Naughton.pdfIn PDF document text
    • http://muicuiu.dumb1.com/5a09a08a08a01/Second-Chances-When-Seconds-Count-1-by-D-L-Roan.pdfIn PDF document text
    • http://muicuiu.dumb1.com/7a07a00a03a06a04/Film-in-Five-Seconds-by-Matteo-Civaschi.pdfIn PDF document text
    • http://muicuiu.dumb1.com/4a06a03a02a09a09/The-Last-Six-Million-Seconds-by-John-Burdett.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a08a06a01a08a05/Final-Seconds-by-John-Lutz.pdfIn PDF document text
    • http://muicuiu.dumb1.com/3a06a01a01a09a04/The-Last-Six-Million-Seconds-by-John-Burdett.pdfIn PDF document text
    • http://muicuiu.dumb1.com/8a03a03a00a09/The-Last-10-Seconds-Tina-Boyd-5-by-Simon-Kernick.pdfIn PDF document text