Malicious PDF — malware analysis report

Static analysis result for SHA-256 33db3d13a1b2199a…

MALICIOUS

PDF

19.9 KB Created: 2020-03-12 01:21:34 +00:00 Authoring application: mPDF 5.7
MD5: 6c3950ccd81c75d4f5b640a96e5a9a4d SHA-1: 5c1cda3d6f2ef61a1c30cae8666789292d523c81 SHA-256: 33db3d13a1b2199a80db0883e4cd4908579642d8b6bca58f3da95e5369e50fce
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection strategy. The ML classifier also flagged this PDF as malicious with high confidence. While no scripts were extracted, the sheer volume of external links points to a malicious intent, likely to distribute further malware or engage in phishing. The primary IOCs are the numerous URLs hosted on eascasas.myhome.cx.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eascasas.myhome.cx/2aa2aa9aa2aa4aa3/Style-Me-Sexy-novella-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/1aa8aa9aa0aa2aa4/Style-Me-Sexy-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/2aa4aa1aa3aa0aa4/When-We-Meet-Again-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/1aa7aa9aa3aa3aa1/Deaf-Isn-t-Dumb-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/4aa5aa0aa8aa4aa1/Love-Request-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/2aa4aa1aa3aa0aa3/Ride-for-Rights-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/1aa7aa9aa0aa2aa1/Operation-Enduring-Santa-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/5aa9aa0aa8aa8aa6/Ride-for-Rights-Derby-Dames-by-Tara-Chevrestt.pdf
    • http://eascasas.myhome.cx/1aa4aa8aa2aa7aa5/A-Night-With-Knox-A-Sexy-Bastard-Novella-by-Eve-Jagger.pdf
    • http://eascasas.myhome.cx/1aa0aa0aa9aa7aa6aa5/Unveiling-Your-Style-Becoming-A-New-You-Through-Fashion-Style-And-Grace-by-Bhoranie-Seide.pdf
    • http://eascasas.myhome.cx/1aa1aa8aa1aa7aa1aa9/Sexy-Lily-amp-ihr-Stiefbruder-Ein-ubgew-hnliches-Sexabenteuer-Sie-sind-jung-sexy-und-denken-sich-einen-unglaublichen-Plan-aus-by-Milo-Arten.pdf
    • http://eascasas.myhome.cx/1aa1aa1aa4aa1aa7aa3/The-Cuckold-Surrender-Hotwife-Femdom-Interracial-Cuckold-Erotica-with-a-sexy-wife-who-s-crazy-for-BBC-and-will-do-anything-for-a-sexy-black-African-dominant-to-be-her-stud-by-Ronnie-Kinski.pdf
    • http://eascasas.myhome.cx/5aa0aa6aa7aa7aa1/Christina-Rossetti-The-Patience-of-Style-the-Patience-of-Style-by-Constance-W-Hassett.pdf
    • http://eascasas.myhome.cx/2aa4aa9aa0/Dirty-Sexy-Saint-Dirty-Sexy-1-by-Carly-Phillips.pdf
    • http://eascasas.myhome.cx/3aa1aa1aa9/Dirty-Sexy-Inked-Dirty-Sexy-2-by-Carly-Phillips.pdf
    • http://eascasas.myhome.cx/6aa1aa4aa3aa0aa8/Aventurile-lui-Alice-n-ara-Minunilor-Alice-n-ara-Oglinzii-i-ce-a-g-sit-acolo-Alice-s-Adventures-in-Wonderland-1-2-by-Lewis-Carroll.pdf
    • http://eascasas.myhome.cx/4aa8aa6aa1aa6aa2/Sexy-Jerk-Sexy-Jerk-World-1-by-Kim-Karr.pdf
    • http://eascasas.myhome.cx/1aa8aa7aa8aa7aa2/Dead-Sexy-Dead-Sexy-1-by-Aleah-Barley.pdf
    • http://eascasas.myhome.cx/2aa7aa7aa6aa0aa2/Sexy-Beast-V-Sexy-Beast-5-by-Kate-Douglas.pdf
    • http://eascasas.myhome.cx/8aa9aa8aa8aa9aa5/THE-21-TARA-S-AND-MERIDIAN-TAPPING-How-To-Use-Meridian-Tapping-To-Awaken-The-Power-Of-The-Goddess-Tara-And-Her-21-Emanations-Tapping-Miracles-Series-Book-3-by-Doron-Alon.pdf
    • http://eascasas.myhome.cx/1

Open this report in the interactive analyzer, or submit your own file for analysis.