Malicious PDF — malware analysis report

Static analysis result for SHA-256 2993dee70bbaa36a…

MALICIOUS

PDF

15.9 KB Created: 2019-05-05 16:52:46 +01:00 Authoring application: mPDF 5.7
MD5: b66565b6b2b578ee5df8817dbb58049f SHA-1: 104ff90f4a2009ae6e5e11228d7e95b86b8f1274 SHA-256: 2993dee70bbaa36a7e4bf06fbf680bb8be600b4caade498e05d34e2e1a7fc326
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the specific URLs appear to be benign, the sheer volume and structure suggest a malicious intent, possibly for SEO manipulation or to distribute further malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged this document with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9892

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a03a04a01a04a03/Fire-in-the-Darkness-Darkness-2-by-Stacey-Marie-Brown.pdf
    • http://muicuiu.dumb1.com/2a05a07a07a07a07/Beast-in-the-Darkness-Darkness-2-5-by-Stacey-Marie-Brown.pdf
    • http://muicuiu.dumb1.com/1a03a02a07a07a06/Darkness-of-Light-Darkness-1-by-Stacey-Marie-Brown.pdf
    • http://muicuiu.dumb1.com/1a03a03a06a07a09/The-Barrier-Between-Collector-2-by-Stacey-Marie-Brown.pdf
    • http://muicuiu.dumb1.com/3a05a00a01a06a02/Enlightened-by-Darkness---Vol-3-As-Darkness-Spreads-Enlightened-By-Darkness-3-by-Robert-Friedrich.pdf
    • http://muicuiu.dumb1.com/5a07a02a08a02/The-Grace-in-Darkness-Darkness-Duet-2-by-Melissa-Andrea.pdf
    • http://muicuiu.dumb1.com/5a04a04a04a09/The-Edge-of-Darkness-Darkness-Duet-1-by-Melissa-Andrea.pdf
    • http://muicuiu.dumb1.com/4a03a04a09a04a09/Ascend-from-Darkness-Cursed-in-Darkness-5-by-Natalie-Hancock.pdf
    • http://muicuiu.dumb1.com/4a05a04a03a08a09/Darkness-Darkness-Charlie-Resnick-12-by-John-Harvey.pdf
    • http://muicuiu.dumb1.com/5a07a00a03a00a03/Scent-of-Darkness-Darkness-Chosen-1-by-Christina-Dodd.pdf
    • http://muicuiu.dumb1.com/1a08a01a08a01a05/Redeemed-in-Darkness-Paladins-of-Darkness-4-by-Alexis-Morgan.pdf
    • http://muicuiu.dumb1.com/4a03a07a01a09/Scent-of-Darkness-Darkness-Chosen-1-by-Christina-Dodd.pdf
    • http://muicuiu.dumb1.com/1a02a00a00a04a08/Emerald-Darkness-Beautiful-Darkness-1-by-Sarra-Cannon.pdf
    • http://muicuiu.dumb1.com/4a03a04a07a04a07/Eternal-Darkness-Cursed-in-Darkness-1-by-Natalie-Hancock.pdf
    • http://muicuiu.dumb1.com/3a05a01a02a02a08/Ascending-Darkness-Shattering-the-Darkness-2-by-Jessica-Spoon.pdf
    • http://muicuiu.dumb1.com/1a04a06a08a01a08/Wake-to-Darkness-Brown-and-de-Luca-2-by-Maggie-Shayne.pdf
    • http://muicuiu.dumb1.com/1a05a02a00a04a04/Southern-Haunts-Devils-in-the-Darkness-by-Alexander-S-Brown.pdf
    • http://muicuiu.dumb1.com/4a08a04a06a09a02/Darkness-Awakened-Darkness-1-by-Katie-Reus.pdf
    • http://muicuiu.dumb1.com/1a08a02a01a01a07/Darkness-Awakened-Darkness-1-by-Katie-Reus.pdf
    • http://muicuiu.dumb1.com/4a00a07a08a08a00/Killing-Darkness-The-Darkness-Saga-2-by-Kat-Daemon.pdf
    • http://muicuiu.dumb1.com/4a05a04a03a08a09/Darkness-Darkness-Charlie-Resn

Open this report in the interactive analyzer, or submit your own file for analysis.