Malicious PDF — malware analysis report

Static analysis result for SHA-256 2dd6e5aac831297c…

MALICIOUS

PDF

19.3 KB Created: 2019-04-30 03:59:14 +01:00 Authoring application: mPDF 5.7
MD5: 40a12f6641677f3f937297c17de36020 SHA-1: bd45de333aa7ecc6cad850d9b75baadc7b1cf910 SHA-256: 2dd6e5aac831297c23cfb1e8497b16b2ff0ab35c7535b6f521dacfe477d84b1b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this document with high confidence. While the document body is heavily obfuscated, the presence of numerous links suggests a malicious intent, possibly for SEO manipulation or to redirect users to malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/8a08a05a08a03a01/The-Merchant-of-Venice-Junior-Certificate-English-A-Romantic-Comedy-by-William-Shakespeare-Folens-Shakespeare-Series-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a01a09a05a07a00/The-Merchant-of-Venice-a-Comedy-Now-Acting-with-Universal-Applause-at-the-Theatres-Royal-in-London-and-Dublin-Written-by-Mr-William-Shakespeare-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a03a03a00a06a00/Shakespeare-s-the-Merchant-of-Venice-For-Use-in-Public-and-High-Schools-With-Annotations-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/1a00a04a08a03a09a09/The-Comedy-of-the-Merchant-of-Venice-Together-with-the-Prose-Narrative-of-the-Play-from-Lamb-s-Tales-from-Shakespeare-with-Notes-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/1a00a05a09a04a09a09/Shakespeare-s-The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a06a03a05a07a00/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a02a09a09a00a00/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/6a08a03a02a02a01/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a06a01a01a04a09/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a06a08a07a00a05/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a09a05a08a00a00/The-Merchant-Of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a04a01a07a06a01/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/6a03a09a02a00a03/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a04a01a08a00a01/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a06a04a06a05a00/The-Merchant-Of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/8a03a02a08a08a04/The-Merchant-of-Venice-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a00a03a03a02a03/The-Merchant-of-Venice-Playgoer-s-Edition-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a07a06a06a05a08/The-Merchant-of-Venice-With-Contemporary-Criticism-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/7a00a04a08a02a02/The-Story-of-the-Merchant-of-Venice-1904-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/5a04a09a00a04a04/The-Merchant-of-Venice---with-introduction-notes-and-questions-for-review-by-William-Shakespeare.pdf
    • http://muicuiu.dumb1.com/1a00a04a08a03a09a09/The-Comedy-of-th

Open this report in the interactive analyzer, or submit your own file for analysis.