Malicious PDF — malware analysis report

Static analysis result for SHA-256 3c3b86da6bf1a988…

MALICIOUS

PDF

18.5 KB Created: 2019-05-07 05:14:43 +01:00 Authoring application: mPDF 5.7
MD5: df4e0667b5aa7b340431b15337270430 SHA-1: 65135017351acf56eab17f4e4a99677c669dfc67 SHA-256: 3c3b86da6bf1a9883bab1a3f4d8a68e0c7ecd797e23257c9c23fbb6bbc029728
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier strongly indicated maliciousness. While no scripts were extracted, the PDF structure itself suggests a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a08a05a07a09a02/Drama-Comes-to-Prior-s-Ford-Prior-s-Ford-2-by-Eve-Houston.pdf
    • http://muicuiu.dumb1.com/4a06a09a02a09a09/Secrets-In-Prior-s-Ford-by-Eve-Houston.pdf
    • http://muicuiu.dumb1.com/6a08a05a01a03a02/The-Good-Soldier-A-Tale-of-Passion-1915-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/3a02a04a03a05a06/The-Good-Soldier-A-Tale-of-Passion-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/2a08a08a09a06a04/The-March-of-Literature-From-Confucius-Day-to-Our-Own-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/4a02a01a07a01a05/The-Good-Soldier-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/2a00a05a00a04a01/The-Queen-Who-Flew-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/3a08a03a08a03a05/The-Fifth-Queen-Crowned-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/3a00a01a03a08a03/Vale-of-Stone-and-Beyond-Paranormal-Mystery-Suspense-and-Drama-Epic-Adventure-Dilemmas-of-a-Dragonslayer-6-by-Ruth-Ford-Elward.pdf
    • http://muicuiu.dumb1.com/2a07a07a04a04a09/All-In-Good-Time-Paranormal-Mystery-Suspense-and-Drama-Epic-Adventure-Dilemmas-of-a-Dragonslayer-5-by-Ruth-Ford-Elward.pdf
    • http://muicuiu.dumb1.com/4a04a09a03a08a07/No-More-Parades-A-Novel-by-Ford-Madox-Ford.pdf
    • http://muicuiu.dumb1.com/3a00a05a01a06a07/FREE-Dilemma-s-of-a-Dragonslayer-Series-Prologue-Paranormal-Mystery-Suspense-and-Drama-Epic-Adventure-by-Ruth-Ford-Elward.pdf
    • http://muicuiu.dumb1.com/3a00a07a04a06a08/The-Basement-by-P-M-Prior.pdf
    • http://muicuiu.dumb1.com/7a05a00a09a06/The-Paw-by-Natalie-Jane-Prior.pdf
    • http://muicuiu.dumb1.com/3a00a02a05a04a03/Dragonslayer-and-His-Sorceress-Paranormal-Mystery-Suspense-and-Drama-Epic-Adventure-Dilemmas-of-a-Dragonslayer-2-by-Ruth-Ford-Elward.pdf
    • http://muicuiu.dumb1.com/1a05a07a02a02a07/Best-Laid-Plans-Shader-2-by-D-P-Prior.pdf
    • http://muicuiu.dumb1.com/9a07a03a04a04/The-Resurrection-of-Deacon-Shader-by-D-P-Prior.pdf
    • http://muicuiu.dumb1.com/1a00a06a07a08a05a02/Really-Wild-Tea-Cosies-by-Loani-Prior.pdf
    • http://muicuiu.dumb1.com/1a02a00a03a04a03/The-Archon-s-Assassin-Shader-4-by-D-P-Prior.pdf
    • http://muicuiu.dumb1.com/2a01a06a00a05a03/Best-Laid-Plans-Shader-2-by-D-P-Prior.pdf
    • http://muicuiu.dumb1.com/3a00a01a03a08a03/Vale-of-Stone-and-Beyond-Paranormal-Mystery-Suspense-and-Drama-Epic-Adventure-Dilemma

Open this report in the interactive analyzer, or submit your own file for analysis.