Malicious PDF — malware analysis report

Static analysis result for SHA-256 33599d2f9c84625b…

MALICIOUS

PDF

20.7 KB Created: 2020-03-15 00:50:06 +00:00 Authoring application: mPDF 5.7
MD5: d45a556de95d19793e14284417544b35 SHA-1: 9bb9a7dae0abbda736a815929925a3674cac3563 SHA-256: 33599d2f9c84625b82c10a29113f8ea347c540e56777f014df060f9d7c8d2a2b
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents hosted on the domain 'eascasas.myhome.cx'. This behavior is indicative of a link farm or a phishing lure, aiming to direct users to potentially malicious content. The ML classifier also flagged this PDF with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9904

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eascasas.myhome.cx/1aa3aa7aa1aa8aa8/Anything-But-Ordinary-Addie-The-True-Story-of-Adelaide-Herrmann-Queen-of-Magic-by-Mara-Rockliff.pdf
    • http://eascasas.myhome.cx/1aa3aa7aa2aa3aa0/Around-America-to-Win-the-Vote-Two-Suffragists-a-Kitten-and-10-000-Miles-by-Mara-Rockliff.pdf
    • http://eascasas.myhome.cx/1aa8aa5aa6aa8aa3/Queen-Zixi-of-Ix-or-the-Story-of-the-Magic-Cloak-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/2aa3aa8aa8aa7aa2/Queen-of-the-Air-A-True-Story-of-Love-and-Tragedy-at-the-Circus-by-Dean-Jensen.pdf
    • http://eascasas.myhome.cx/4aa8aa7aa1aa1aa7/Victoria-and-Abdul-The-True-Story-of-the-Queen-s-Closest-Confidant-by-Shrabani-Basu.pdf
    • http://eascasas.myhome.cx/8aa4aa9aa6aa7aa3/From-Bellshill-to-Charleroi-From-the-Journal-of-Andrew-Addie-1923-by-Andrew-Addie.pdf
    • http://eascasas.myhome.cx/8aa0aa6aa6aa5aa8/California-Dreamin-The-True-Story-of-the-Mamas-and-the-Papas-The-Music-the-Madness-the-Magic-that-was-by-Michelle-Phillips.pdf
    • http://eascasas.myhome.cx/2aa3aa6aa4aa5aa5/The-Magic-Castle-A-Mother-s-Harrowing-True-Story-of-Her-Adoptive-Son-s-Multiple-Personalities--and-the-Triumph-of-Healing-by-Carole-Smith.pdf
    • http://eascasas.myhome.cx/2aa9aa3aa4aa2aa4/Ordinary-Magic-by-Malcolm-J-Bosse.pdf
    • http://eascasas.myhome.cx/5aa0aa1aa3aa5aa4/Ordinary-Magic-by-Caitlen-Rubino-Bradway.pdf
    • http://eascasas.myhome.cx/2aa8aa4aa1aa4aa3/Death-and-Relaxation-Ordinary-Magic-1-by-Devon-Monk.pdf
    • http://eascasas.myhome.cx/2aa3aa0aa4aa6aa7/Warrior-Queen-The-Story-of-Boudica-Celtic-Queen-by-Alan-Gold.pdf
    • http://eascasas.myhome.cx/9aa6aa1aa5aa1aa1/Lose-Bande-Horst-Martin-Herrmann-Christian-Rothmann-Toni-Wirthmuller-Pomona-Zipser-Die-Ateliergemeinschft-Z-Art-by-Horst-Martin-Herrmann.pdf
    • http://eascasas.myhome.cx/1aa1aa3aa2aa0aa5aa4/The-Evolution-of-Mara-Dyer-Mara-Dyer-v-ltoz-sa-Mara-Dyer-2-by-Michelle-Hodkin.pdf
    • http://eascasas.myhome.cx/3aa6aa3aa3aa3aa9/The-Extraordinary-Presence-of-God-True-Stories-of-Faith-and-Courage-in-Ordinary-Lives-by-Ann-White-Knowles.pdf
    • http://eascasas.myhome.cx/2aa3aa9aa8aa0aa7/Daughter-of-the-Mara-The-Mara-Chronicles-1-by-Alexandra-Bittner.pdf
    • http://eascasas.myhome.cx/4aa0aa1aa0aa6aa8/Can-We-Play-A-Pop-Up-Lift-the-Flap-Story-About-the-days-of-the-Week-by-Mara-Van-Der-Meer.pdf
    • http://eascasas.myhome.cx/2aa6aa2aa7aa1aa7/If-You-Love-Me-True-love-True-terror-True-story-by-Alice-Keale.pdf
    • http://eascasas.myhome.cx/9aa3aa6aa7aa9aa7/Extra-Ordinary-The-Hugh-Beaty-Story-by-Mark-Cullen.pdf
    • http://eascasas.myhome.cx/3aa2aa6aa1aa5aa9/The-True-Queen-Sorcerer-Royal-2-by-Zen-Cho.pdf
    • http://eascasas.myhome.cx/8aa0aa6aa6aa5aa8/C

Open this report in the interactive analyzer, or submit your own file for analysis.