Malicious PDF — malware analysis report

Static analysis result for SHA-256 378101bf4ff72594…

MALICIOUS

PDF

13.9 KB Created: 2019-05-07 04:18:21 +01:00 Authoring application: mPDF 5.7
MD5: 1ea4ca0469e790ea1ff1fa6029781331 SHA-1: 1b1a44917e612c58ef8575b21e80631d6ceaf6cc SHA-256: 378101bf4ff72594c0ef27b2ecd0ad6487ab51fb5d1abd290cd2469b1339b83c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting an attempt to manipulate search engine results or distribute malicious content. While the document body is unreadable, the presence of numerous links, many pointing to book-related titles, indicates a potential lure. The ML classifier also flagged this PDF as malicious with high confidence. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.li
    • http://xiixmcuin.linkpc.net/8208205207201200/CfE-Higher-Biology-Grade-Booster-by-Leckie-amp-Leckie.pdf
    • http://xiixmcuin.linkpc.net/4203200207203204/A-Minor-Raven-Boys-Holiday-Drabble-The-Raven-Cycle-0-4-by-Maggie-Stiefvater.pdf
    • http://xiixmcuin.linkpc.net/8208205207201202/Practice-Question-Book-for-CfE-and-SQA-Higher-Chemistry-Practice-Question-Book-by-Leckie-and-Leckie.pdf
    • http://xiixmcuin.linkpc.net/1200208204203206209/Raven-s-Tears-The-Raven-amp-The-Iris-1-by-Alesia-Matson.pdf
    • http://xiixmcuin.linkpc.net/2209204201202206/Raven-s-Shadow-Raven-Duology-1-by-Patricia-Briggs.pdf
    • http://xiixmcuin.linkpc.net/3201207207203/The-Raven-Boys-The-Raven-Cycle-1-by-Maggie-Stiefvater.pdf
    • http://xiixmcuin.linkpc.net/1201208202206200/Raven-s-Blood-Raven-Chronicles-4-by-Deborah-Cannon.pdf
    • http://xiixmcuin.linkpc.net/4207204206207202/Raven-s-Kiss-Raven-Grace-1-by-Toni-LoTempio.pdf
    • http://xiixmcuin.linkpc.net/4207200202203207/The-Raven-Boys-Raven-Cycle-1-by-Maggie-Stiefvater.pdf
    • http://xiixmcuin.linkpc.net/4203204204203/Raven-The-Raven-Saga-1-by-Suzy-Turner.pdf
    • http://xiixmcuin.linkpc.net/2202207203204208/Snow-Raven-Raven-3-by-Patricia-McAllister.pdf
    • http://xiixmcuin.linkpc.net/2201208203205200/Raven-s-Strike-Raven-2-by-Patricia-Briggs.pdf
    • http://xiixmcuin.linkpc.net/8209208208207207/White-Raven-Raven-1-by-J-L-Weil.pdf
    • http://xiixmcuin.linkpc.net/1209205205205202/White-Raven-Raven-1-by-J-L-Weil.pdf
    • http://xiixmcuin.linkpc.net/8208205207201207/More-Other-Homes-and-Garbage-by-Jim-Leckie.pdf
    • http://xiixmcuin.linkpc.net/3209204207202205/She-Commands-Me-and-I-Obey-by-Ann-Leckie.pdf
    • http://xiixmcuin.linkpc.net/3201205209204203/Underdog-by-Euan-Leckie.pdf
    • http://xiixmcuin.linkpc.net/3207202209202209/The-Dark-Tower-The-Dark-Tower-7-by-Stephen-King.pdf
    • http://xiixmcuin.linkpc.net/8208205206205202/The-Story-Of-Football-by-Robert-Leckie.pdf
    • http://xiixmcuin.linkpc.net/8208205206206200/The-World-War-II-Reader-by-Robert-Leckie.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.