Malicious PDF — malware analysis report

Static analysis result for SHA-256 2ed5886bfa44f4da…

MALICIOUS

PDF

21.3 KB Created: 2019-04-30 05:44:20 +01:00 Authoring application: mPDF 5.7
MD5: cd38f841f97bdb0860f04eae57093a5f SHA-1: af2f9dcbdd369a79ec832b8b5ec45ee3120ec58a SHA-256: 2ed5886bfa44f4da14470054170aff97ffec7bbe9c8fbd75373be6e18457e63f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. While the ML classifier also flagged this as malicious, the specific intent appears to be SEO manipulation or a link farm rather than direct payload delivery. The majority of extracted URLs were confirmed as benign, suggesting the primary malicious activity is the link farm itself.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9900

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://unieoooq.linkpc.net/14e04e54e94e44e24e5/Die-G-tterkriege-Reihe-in-7-B-nden-by-Richard-Schwartz.pdf
    • http://unieoooq.linkpc.net/34e84e54e94e64e3/Internal-Family-Systems-Therapy-by-Richard-C-Schwartz.pdf
    • http://unieoooq.linkpc.net/94e14e64e84e54e1/Again-Reihe-Reihe-in-3-B-nden-by-Mona-Kasten.pdf
    • http://unieoooq.linkpc.net/94e34e94e34e34e5/Die-Eule-von-Askir-Die-komplette-Fassung-Das-Geheimnis-von-Askir-6-by-Richard-Schwartz.pdf
    • http://unieoooq.linkpc.net/14e04e84e94e44e54e5/S-Mmtliche-Werke-In-Vierzig-B-Nden-Volumes-19-20-by-Johann-Wolfgang-von-Goethe.pdf
    • http://unieoooq.linkpc.net/14e14e44e14e54e04e6/G-ldene-Aepfel-in-Silbernen-Schalen-Das-Ist-Worte-Geredet-Zu-Seiner-Zeit-ber-400-Sinnbilder-Von-Allerley-Zeiten-Und-Umst-nden-Des-Menschlichen-Lebens-Zu-Bef-rderung-Der-Erbauung-by-Johann-Andreas-Pfeffel.pdf
    • http://unieoooq.linkpc.net/14e14e14e64e14e44e1/Mari-H-chst-Wunderbarliche-Und-Ohne-Alle-S-nden-Mackl-Gnaden-Reich-Beschehene-Empf-ngnu-In-Hunderterley-Si--Bildern-Vorgestellt-Nit-Minder-Zu-Nutzen-De-Teutschen-Lesers-in-Gemeiner-Mutter-Schprach-Durch-Gleich-Lauffende-Vers-Deutlich-Erkl-ret-by-Joseph-Zoller.pdf
    • http://unieoooq.linkpc.net/64e84e04e24e04e8/Works-by-Richard-Matheson-Novels-by-Richard-Matheson-Screenplays-by-Richard-Matheson-Short-Stories-by-Richard-Matheson-by-Books-LLC.pdf
    • http://unieoooq.linkpc.net/14e14e14e44e94e84e0/Bunte-Reihe-by-Georg-B-tticher.pdf
    • http://unieoooq.linkpc.net/54e34e14e94e04e3/Infernale-Reihe-in-2-B-nden-by-Sophie-Jordan.pdf
    • http://unieoooq.linkpc.net/14e04e64e34e54e94e2/Nashira-Reihe-in-2-B-nden-by-Licia-Troisi.pdf
    • http://unieoooq.linkpc.net/14e04e14e64e84e04e4/Fuchsgeist-Fuchs-Reihe-1-by-Nicky-P-Kiesow.pdf
    • http://unieoooq.linkpc.net/14e14e54e04e84e04e6/Numbers-Reihe-in-3-B-nden-by-Rachel-Ward.pdf
    • http://unieoooq.linkpc.net/74e84e04e04e14e4/Cat-amp-Bones-Reihe-in-7-B-nden-by-Jeaniene-Frost.pdf
    • http://unieoooq.linkpc.net/94e14e54e04e74e3/Eis-wie-Feuer-Die-Ice-like-Fire-Reihe-2-by-Sara-Raasch.pdf
    • http://unieoooq.linkpc.net/14e04e14e24e94e34e9/Geile-Luder-Reihe-H-hepunkte-by-M-C-Hanlon.pdf
    • http://unieoooq.linkpc.net/94e14e94e64e64e3/Das-Buch-der-Gef-hrten-Reihe-in-3-B-nden-by-R-A-Salvatore.pdf
    • http://unieoooq.linkpc.net/94e34e94e84e54e2/Lippel-Reihe-in-2-B-nden-by-Paul-Maar.pdf
    • http://unieoooq.linkpc.net/84e64e04e84e24e6/Nachtschatten-Reihe-in-3-B-nden-by-Juliane-Seidel.pdf
    • http://unieoooq.linkpc.net/74e44e94e14e74e1/Katzen-Issues-Reihe-in-2-B-nden-by-Brr-maud.pdf
    • http://unieoooq.linkpc.net/14e14e14e64e14e44e1/Mari-H-chst-Wunderbarliche-Und-Ohne-Alle-S-nden-Mackl-Gnaden-Reich-Beschehene-Empf-ngnu-In-Hunderterle