Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ee8c54ce8bf3a6b…

MALICIOUS

PDF

19.8 KB Created: 2020-03-18 23:01:14 +00:00 Authoring application: mPDF 5.7
MD5: 24c7c6ed5dbc62f58deb469537d369df SHA-1: 269201c582baccf3cec9986d16244f5583c11c28 SHA-256: 3ee8c54ce8bf3a6b6a5b815d4ff114594b27b8417576953c1ed8e520e922f205
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF documents hosted on the domain eascasas.myhome.cx. This behavior is indicative of a link farm or a distribution point for further malicious content. The ML classifier strongly supports the malicious verdict, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious nature of the embedded URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9922

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eascasas.myhome.cx/2aa4aa2aa9aa4aa3/The-Ramayana-Enigma-The-untold-story-of-the-disappearance-of-the-Rama-Empire-of-India-Rama-Empire-1-amp-2-by-Lakshmi-Hayagriva.pdf
    • http://eascasas.myhome.cx/7aa3aa5aa2aa3aa8/The-Song-of-Rama-Visions-of-the-Ramayana-by-Vanamali.pdf
    • http://eascasas.myhome.cx/7aa3aa5aa2aa3aa9/The-Oracle-of-Rama-An-Adaptation-of-Rama-Ajna-Prashna-of-Goswami-Tulsidas-with-commentary-by-David-Frawley.pdf
    • http://eascasas.myhome.cx/4aa1aa2aa0aa5aa2/Rama-Revealed-The-Ultimate-Encounter-Rama-4-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/7aa3aa5aa3aa5aa9/Rama-Gita-The-Dialogues-Of-Rama-by-Anantanand-Rambachan.pdf
    • http://eascasas.myhome.cx/7aa3aa5aa1aa3aa8/Parables-of-Rama-by-Swami-Rama-Tirtha-by-shankara_2000.pdf
    • http://eascasas.myhome.cx/5aa7aa6aa9aa4/The-Garden-of-Rama-Rama-3-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/4aa0aa9aa4aa0aa8/Rendezvous-with-Rama-Rama-1-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/4aa0aa2aa7aa5aa7/Rendezvous-with-Rama-Rama-1-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/5aa5aa5aa2aa0/The-Garden-of-Rama-Rama-3-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/2aa4aa6aa3aa4/Rendezvous-with-Rama-Rama-1-by-Arthur-C-Clarke.pdf
    • http://eascasas.myhome.cx/3aa3aa9aa3aa7aa9/Home-to-India-by-Santha-Rama-Rau.pdf
    • http://eascasas.myhome.cx/7aa3aa5aa2aa3aa2/A-Never-Before-World-Tracking-the-Evolution-of-Consumer-India-by-Rama-Bijapurkar.pdf
    • http://eascasas.myhome.cx/4aa8aa8aa5aa2/Savages-and-Scoundrels-The-Untold-Story-of-America-s-Road-to-Empire-through-Indian-Territory-by-Paul-VanDevelder.pdf
    • http://eascasas.myhome.cx/4aa4aa2aa3/An-Era-of-Darkness-The-British-Empire-in-India-by-Shashi-Tharoor.pdf
    • http://eascasas.myhome.cx/5aa8aa2aa7aa2aa9/Empire-s-Garden-Assam-and-the-Making-of-India-by-Jayeeta-Sharma.pdf
    • http://eascasas.myhome.cx/7aa7aa0aa1aa4aa0/The-Fall-of-Constantinople-The-Rise-of-the-Ottoman-Empire-and-the-End-of-the-Byzantine-Empire-by-Charles-River-Editors.pdf
    • http://eascasas.myhome.cx/4aa6aa9aa5aa2aa1/Daughter-of-the-Empire-The-Empire-Trilogy-1-by-Raymond-E-Feist.pdf
    • http://eascasas.myhome.cx/4aa3aa7aa7aa7aa9/The-Old-Man-and-the-Sea-by-P-G-Rama-Rao.pdf
    • http://eascasas.myhome.cx/2aa3aa1aa8aa6/British-Empire-Before-the-American-Revolution-Triumphant-Empire-the-Rumbling-of-the-Coming-Storm-1766-1770-by-Lawrence-Henry-Gipson.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.