Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f7a1a7eaf39abad…

MALICIOUS

PDF

15.8 KB Created: 2019-05-03 05:31:15 +01:00 Authoring application: mPDF 5.7
MD5: d075c3c02b262465fb1a91fbe78a6bb0 SHA-1: 441913d8636c86bb220168ce6dc30ab5762ac1fd SHA-256: 2f7a1a7eaf39abade0ead20d3c9f834364789a1e82305cabdaa2fec84a30307b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to a single domain, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged the document as malicious. While the document body is heavily obfuscated, the presence of numerous links to external PDFs suggests a link farm or SEO poisoning tactic to drive traffic to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9800

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a03a03a08a00a02/Cockatiels-at-Seven-Meg-Langslow-9-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/4a03a04a01a00a01/The-Hen-of-the-Baskervilles-Meg-Langslow-15-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/4a08a09a01a04a07/We-ll-Always-Have-Parrots-Meg-Langslow-5-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/3a08a07a03a05a04/Chesapeake-Crimes-3-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/1a05a08a03a00a02/Hen-of-the-Baskervilles-Meg-Langslow-15-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/4a00a05a02a02a02/Lord-of-the-Wings-Meg-Langslow-19-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/2a06a08a07a06/Murder-With-Peacocks-Meg-Langslow-1-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/3a02a04a09a07a05/Hen-of-the-Baskervilles-A-Meg-Langslow-Mystery-15-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/1a03a03a02a00a02/Murder-With-Puffins-Meg-Langslow-2-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/3a05a07a08a03a05/Access-Denied-Turing-Hopper-3-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/8a07a02a09a02a09/Lark-The-Herald-Angels-Sing-Meg-Langslow-24-by-Donna-Andrews.pdf
    • http://muicuiu.dumb1.com/2a05a08a05a05a00/Deadly-Curses-Magnolia-Valley-Series-by-Donna-Shields.pdf
    • http://muicuiu.dumb1.com/5a03a05a06a03a04/Revenge-The-7th-Deadly-Sin-Alternate-Ending-G-Spot-2-The-Seven-Deadly-Sins-by-Noire.pdf
    • http://muicuiu.dumb1.com/1a03a03a04a03a03/Deadly-Love-Francesca-Cahill-Deadly-1-by-Brenda-Joyce.pdf
    • http://muicuiu.dumb1.com/4a03a09a04a09a00/Deadly-Deception-A-Deadly-Novel-Book-One-by-Andrea-Johnson-Beck.pdf
    • http://muicuiu.dumb1.com/2a05a08a00a09a08/Deadly-Obsession-Deadly-Vices-1-by-Kristine-Cayne.pdf
    • http://muicuiu.dumb1.com/1a08a00a00a04a09/Deadly-Pack-Deadly-Trilogy-3-by-Ashley-Stoyanoff.pdf
    • http://muicuiu.dumb1.com/2a08a00a07a08a00/Deadly-Crush-Deadly-Trilogy-1-by-Ashley-Stoyanoff.pdf
    • http://muicuiu.dumb1.com/2a01a02a01a03a01/Deadly-Mates-Deadly-Trilogy-2-by-Ashley-Stoyanoff.pdf
    • http://muicuiu.dumb1.com/2a08a06a02a05a01/Deadly-Dreams-Deadly-Mystery-3-by-Victor-J-Banis.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.