Malicious PDF — malware analysis report

Static analysis result for SHA-256 352d3fd18e3f931f…

MALICIOUS

PDF

21.8 KB Created: 2019-04-30 12:05:45 +01:00 Authoring application: mPDF 5.7
MD5: 0b20bbbaae0eaa7678fd21424307099d SHA-1: 8f489f9b32e1f022a81ee623f72feea3522de9bc SHA-256: 352d3fd18e3f931f8bc92f35d37d25db157ca78512487be80c05d0f08387bb9e
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files, likely intended to trick users into downloading and opening them. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://seasasac.lflinkup.com/6da0da2da8da0/The-Foundation-Novels-7-Book-Bundle-Foundation-Foundation-and-Empire-Second-Foundation-Foundation-s-Edge-Foundation-and-Earth-Prelude-to-Foundation-Forward-the-Foundation-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/2da9da2da9da9da4/Articles-on-Foundation-Universe-Books-Including-I-Robot-Foundation-s-Edge-the-Caves-of-Steel-Prelude-to-Foundation-Foundation-and-Earth-Foundation-Series-Isaac-Asimov-s-Robot-Series-Isaac-Asimov-s-Galactic-Empire-Series-by-Hephaestus-Books.pdf
    • http://seasasac.lflinkup.com/2da9da2da4da3da7/Prelude-to-Foundation-Foundation-1-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/2da5da7da7da2da8/Foundation-Foundation-and-Empire-Second-Foundation-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/1da0da5da3da0da0/Foundation-and-Earth-Foundation-5-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/3da2da6da2da7da1/Foundation-s-Edge-Foundation-4-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/5da2da6da8da6da3/The-Foundation-Trilogy-Foundation-1-3-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/4da0da5da7da7da7/Foundation-and-Empire-Foundation-2-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/2da4da6da6da3/The-Foundation-Trilogy-Foundation-1-3-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/3da2da6da2da6da0/Foundation-and-Empire-Foundation-2-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/3da4da0da3da9da2/Foundation-Foundation-1-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/1da8da2da9da4da4/Foundation-Foundation-1-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/1da5da9da9da7da3/Foundation-s-Triumph-Second-Foundation-Trilogy-3-by-David-Brin.pdf
    • http://seasasac.lflinkup.com/6da6da1da7da8da5/Implementing-Cisco-IOS-Network-Security-IINS-640-554-Foundation-Learning-Guide-Foundation-Learning-Guides-by-Catherine-Paquet.pdf
    • http://seasasac.lflinkup.com/8da5da6da5da1da5/Testimony-The-Legacy-of-Schindler-s-List-and-the-Shoah-Foundation-20th-Anniversary-Commemorative-Edition-by-USC-Shoah-Foundation.pdf
    • http://seasasac.lflinkup.com/4da5da6da6da3da4/Isaac-Asimov-Presents-The-Great-SF-Stories-3-1941-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/1da2da9da7da6da5/Isaac-Asimov-s-Caliban-Isaac-Asimov-s-Caliban-1-by-Roger-MacBride-Allen.pdf
    • http://seasasac.lflinkup.com/2da6da8da1da2/The-early-Asimov-or-Eleven-Years-of-Trying-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/7da8da1da3da3da9/The-Early-Asimov-Volume-3-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/6da2da8da8da9da8/The-Early-Asimov-Book-Two-by-Isaac-Asimov.pdf
    • http://seasasac.lflinkup.com/

Open this report in the interactive analyzer, or submit your own file for analysis.