Malicious PDF — malware analysis report

Static analysis result for SHA-256 378ff41dd51bc8e2…

MALICIOUS

PDF

17.5 KB Created: 2019-05-01 20:33:39 +01:00 Authoring application: mPDF 5.7
MD5: abca53b81da71533f3a1e4282512d226 SHA-1: b7fb95efa0401a47cb01b2641f9fb5c9e418e887 SHA-256: 378ff41dd51bc8e2fbfac161508d96c0db823de60b693eb1d5db8033520dfa94
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. While many of these URLs point to benign-looking documents, the sheer volume and the heuristic's classification suggest a malicious intent, possibly for SEO poisoning or to distribute further malware. The ML_NYX_PDF_MALICIOUS classifier strongly supports this assessment. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/7207203206206204/The-Ethics-Treatise-on-the-Emendation-of-the-Intellect-Selected-Letters-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/7207203207203209/The-Essential-Spinoza-Ethics-and-Related-Writings-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/1201208205207201207/Spinoza-Theologisch-politische-Abhandlung-Kritik-an-der-religi-sen-Intoleranz-und-ein-Pl-doyer-f-r-eine-s-kularisierte-Gesellschaftsordnung-by-Baruch-de-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/7207203207203201/Philosophy-of-Benedict-de-Spinoza-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/7207203207208202/Spinoza-s-Short-Treatise-on-God-Man-and-His-Well-Being-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/2202202201200206/Complete-Works-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/7207203206206207/On-the-Improvement-of-the-Understanding-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/3209207203204207/Tractatus-Theologico-Politicus-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/7207203207204203/Ethics-On-the-Improvement-of-the-Understanding-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/5203208209205201/L-thique-Nouvelle-dition-augment-e---Arvensa-Editions-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/1200206200206200203/Ethik-Grossdruck-In-Geometrischer-Weise-Behandelt-in-Funf-Teilen-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/1200202203203207204/Samtliche-Werke-Band-2-Ethik-in-geometrischer-Ordnung-dargestellt-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/9206209207205202/Theologisch-politische-Abhandlung-Tractatus-theologico-politicus---Vollst-ndige-deutsche-Ausgabe-Kritik-an-der-religi-sen-Intoleranz-und-ein-Pl-doyer-Gesellschaftsordnung-by-Baruch-Spinoza.pdf
    • http://xiixmcuin.linkpc.net/2204201207206202/The-Stigmatist-by-Hurd-Baruch.pdf
    • http://xiixmcuin.linkpc.net/9202206202201208/Psychological-And-Behavioral-Aspects-Of-Diving-by-Baruch-Nevo.pdf
    • http://xiixmcuin.linkpc.net/1202205205207205/Makar-and-Baruch-Fueled-By-Lust-7-by-Celeste-Prater.pdf
    • http://xiixmcuin.linkpc.net/7200200200203208/101-Letters-to-a-Prime-Minister-The-Complete-Letters-to-Stephen-Harper-by-Yann-Martel.pdf
    • http://xiixmcuin.linkpc.net/6204201205206200/Letters-to-Atticus-vol-1-Letters-1-89-by-Marcus-Tullius-Cicero.pdf
    • http://xiixmcuin.linkpc.net/7207203207209203/Spinoza-Now-by-Dimitris-Vardoulakis.pdf
    • http://xiixmcuin.linkpc.net/7207203208202200/The-Trials-of-Spinoza-by-Tariq-Ali.pdf
    • http://xiixmcuin.linkpc.net/3209207203204207/Tract

Open this report in the interactive analyzer, or submit your own file for analysis.