Malicious PDF — malware analysis report

Static analysis result for SHA-256 353f02c78ca11603…

MALICIOUS

PDF

25.5 KB Created: 2019-05-03 06:02:18 +01:00 Authoring application: mPDF 5.7
MD5: 148f0f82bcd4a2444933f39f050850dd SHA-1: 9fa896bacc03c4648c58f7bc4290a1125ce95924 SHA-256: 353f02c78ca11603b4385878b212c839299461303e976f1c93d63622d623d2c6
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While many of these URLs were labeled as confirmed benign, the sheer volume and the ML classifier's high confidence score suggest a malicious intent, likely for SEO manipulation or to serve as a distribution point for further malicious content. The presence of embedded URLs within the document body, despite being heavily obfuscated, supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9910

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/1b21b23b20b29b27b28/Karl-Schmidt-Rottluff-Works-in-the-Kunstsammlungen-Chemnitz-by-Ingrid-M-ssinger.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b29b25/Kultur-Chemnitz-Kunstler-Chemnitz-Medien-Chemnitz-Museum-in-Chemnitz-Karl-Schmidt-Rottluff-Stefan-Heym-Michael-Degen-by-Quelle-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b28b25b29/Bauwerk-in-Chemnitz-Chemnitz-Hauptbahnhof-Sehenswurdigkeiten-in-Chemnitz-Hoher-Turm-Kaufhaus-Schocken-Karl-Marx-Monument-Burg-Rabenst-by-Source-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b29b23/Bildung-Und-Forschung-in-Chemnitz-Hochschullehrer-Chemnitz-Schule-in-Chemnitz-Technische-Universitat-Chemnitz-Heiner-Rindermann-by-Quelle-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b28b20/Chemnitzs-Works-Church-Order-by-Martin-Chemnitz.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b21b20b21b24/Chemnitz-s-Works-Volume-10-Apology-of-the-Book-of-Concord-by-Kevin-Walker.pdf
    • http://cmeinasaoo.duckdns.org/4b26b29b28b29b29/How-Google-Works-by-Eric-Schmidt.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b21b20b22b23/Agricola-Vortrage-Chemnitz-1994-26-Marz-1994-Offentliche-Vortragsveranstaltung-Der-Technischen-Universitat-Chemnitz-Zwickau-Und-Der-G-by-Werner-Kroker.pdf
    • http://cmeinasaoo.duckdns.org/1b21b24b22b22b29b29/Collected-Works-of-Friedrich-Heinrich-Karl-Freiherr-de-la-Motte-Fouque-by-Friedrich-Heinrich-Karl-La-Motte-Fouque.pdf
    • http://cmeinasaoo.duckdns.org/5b29b21b24b23b27/The-Classic-Works-of-J--K-Huysmans-by-Joris-Karl-Huysmans.pdf
    • http://cmeinasaoo.duckdns.org/5b22b28b21/The-Marvelous-Misadventures-of-Ingrid-Winter-Ingrid-Winter-Misadventure-1-by-J-S-Drangsholt.pdf
    • http://cmeinasaoo.duckdns.org/2b21b27b26b22/About-Schmidt-Schmidt-1-by-Louis-Begley.pdf
    • http://cmeinasaoo.duckdns.org/7b26b22b23b20b27/Karl-Marks-i-sotsialisticheskaia-revoliutsiia-Karl-Marx-and-the-socialist-revolution-by-Grigori-Zinoviev.pdf
    • http://cmeinasaoo.duckdns.org/9b20b25b22b27b23/Profiles-on-Success-with-Karl-Lessmann-Proven-Strategies-from-Today-s-Leading-Experts-by-Karl-Lessman.pdf
    • http://cmeinasaoo.duckdns.org/1b21b20b23b27b23b22/Literarische-Zust-nde-Und-Zeitgenossen-Vol-1-In-Schilderungen-Aus-Karl-Aug-B-ttiger-s-Handschriftlichem-Nachlasse-by-Karl-August-Bottiger.pdf
    • http://cmeinasaoo.duckdns.org/1b21b26b28b29b28b29/Der-F-rst-der-Bleichgesichter-Teil-1-Jubil-umsausgabe-zum-100-Todestag-von-Karl-May-by-Karl-May.pdf
    • http://cmeinasaoo.duckdns.org/5b29b22b22b29b24/Gnu-Octave-Beginner-s-Guide-Jesper-Schmidt-Hansen-by-Jesper-Schmidt-Hansen.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b28b28/Justification-by-Martin-Chemnitz.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b28b24/Loci-Theologici-by-Martin-Chemnitz.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b28b26b27/Chemnitz-in-Alten-Ansichtskarten-by-Brigitte-Weidlich.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b20b27b29b23/Bildung-Und-Forschung-in-Chemnitz-Hochschullehrer-Chemnitz-Schule-in-Chemnitz-Technische-Universitat-Chemnitz-Heiner-Ri

Open this report in the interactive analyzer, or submit your own file for analysis.