Malicious PDF — malware analysis report

Static analysis result for SHA-256 30fd186b8c1d89fd…

MALICIOUS

PDF

17.1 KB Created: 2019-05-05 15:57:27 +01:00 Authoring application: mPDF 5.7
MD5: a8c192ec3e38e304cabc29983c517e5d SHA-1: 820f35eae5bc6c3a48b2b3766d2c7b14d19b0b99 SHA-256: 30fd186b8c1d89fde847fbf6129cc2c132a2b382a67ca960c3a894c064266bbe
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified as a link farm. While the specific URLs extracted are marked as benign, the heuristic 'PDF_SEO_LINK_FARM' and the ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, also contains these URLs. The primary attack pattern appears to be the distribution of a large number of links, likely to redirect users to malicious sites or for SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9899

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a04a08a00a03a05/Wetwork-The-Works-3-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/3a09a06a00a05a00/Working-Out-The-Works-2-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/2a06a08a03a00a07/What-to-Do-with-a-Bad-Boy-The-McCauley-Brothers-4-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/3a08a00a08a09a04/Namesake-Voiders-1-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/2a07a08a06a09a09/Derrick-Circe-s-Recruits-3-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a04a07a07/Zack-amp-Ace-Circe-s-Recruits-2-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/9a06a07a07a08a06/Aftershocks-Storm-Lords-4-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a06a03a04/A-Major-Attraction-Good-to-Go-1-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a04a03a05/Roane-Circe-s-Recruits-1-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/4a09a05a04a04a03/Hale-Circe-s-Recruits-4-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a04a08a00/Derrick-Circe-s-Recruits-3-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/2a09a05a07a07a06/The-Perfect-Creation-Creations-1-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/2a05a09a08a08a07/Rachel-s-Totem-Cougar-Falls-1-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/2a01a04a01a00a01/How-to-Handle-a-Heartbreaker-The-McCauley-Brothers-2-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/1a00a00a04a04a08a04/A-Matter-of-Pride-Cougar-Falls-5-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/3a00a05a03a01a07/Prey-amp-Prejudice-Cougar-Falls-8-by-Marie-Harte.pdf
    • http://muicuiu.dumb1.com/3a09a05a02a02a00/Rules-of-Harte-Harte-1-by-Brooke-Harris.pdf
    • http://muicuiu.dumb1.com/6a02a04a00a03a00/The-Life-And-Works-Of-Edgar-Allan-Poe-A-Psycho-Analytic-Interpretation-by-Marie-Bonaparte.pdf
    • http://muicuiu.dumb1.com/1a00a09a01a04a07a09/Of-Reason-And-Love-The-Life-And-Works-Of-Marie-Von-Ebner-Eschenbach-1830-1916-by-Carl-Steiner.pdf
    • http://muicuiu.dumb1.com/1a01a02a00a06a09a06/Pulitzer-Prize-Winning-Works-Collections-11-Works-One-of-Ours-Alice-Adams-Anna-Christie-Miss-Lulu-Bett-by-Willa-Cather.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.