Malicious PDF — malware analysis report

Static analysis result for SHA-256 403aa30023698be2…

MALICIOUS

PDF

34.5 KB Created: 2019-05-02 01:15:37 +01:00 Authoring application: mPDF 5.7 First seen: 2021-06-28
MD5: 5e9fe44781d912b5a30d221facb9432d SHA-1: e7e3ef9961b383f013d1c3e77a4827f9710bbf2c SHA-256: 403aa30023698be23b467edbd9ce7fb40d726d8aefa5841968bc2020f1a4be9b
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, suggesting a link farm or SEO poisoning attempt. While the document body is heavily obfuscated, the heuristic firings and embedded URLs indicate a malicious intent to redirect users to potentially harmful content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9636

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a00a02a02a06a05a00/G8-Gipfel-G8-Gipfel-in-Heiligendamm-2007-G8-Gipfel-in-Genua-2001-G6-Gipfel-in-Rambouillet-1975-G8-Gipfel-in-T-Yako-2008-by-Quelle-Wikipedia.pdf In PDF document text
    • http://muicuiu.dumb1.com/1a00a02a02a04a07a09/Genua-G8-Gipfel-in-Genua-2001-Krieg-Von-Saint-Sabas-Genueser-Kolonien-Republik-Genua-Maria-Brignole-Sale-de-Ferrari-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a01a03a00a06a03/EU-Gipfel-28-H-hepunkte-Europas-auf-die-man-stehen-muss-by-Wolfgang-Machreich.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a02a02a04a00a03/Genua-Provincie-Gemeente-in-Genua-Geschiedenis-Van-Genua-Plaats-in-Genua-Christoffel-Columbus-Slag-Bij-Lepanto-Republiek-Genua-by-Bron-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a02a02a05a01a03/Verwaltungsgliederung-Ligurien-Comunita-Montana-in-Ligurien-Fraktion-in-Ligurien-Gemeinde-in-Ligurien-Genua-Seborga-La-Spezia-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a02a02a06a00a03/Palast-in-Italien-Palast-in-Genua-Palast-in-Sizilien-Dogenpalast-Palazzo-Pubblico-Fontego-Dei-Turchi-Palazzo-Dario-CA-Rezzonico-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a03a03a02a09a02/Get-Your-War-On-The-Definitive-Account-of-the-War-on-Terror-2001-2008-by-David-Rees.pdfIn PDF document text
    • http://muicuiu.dumb1.com/7a09a00a02a02a07/Mathematical-Olympiad-in-China-2007-2008-Problems-and-Solutions-by-Xiong-Bin.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a08a03a03a06a00/The-Greatest-Salesman-in-the-World-2001-2001-Gift-Edition-by-Og-Mandino.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a04a03a09a03a01/Psychologisches-Werk-Das-Ich-Und-Das-Es-Verbal-Behavior-Das-Unbehagen-in-Der-Kultur-Totem-Und-Tabu-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a04a07a09a04a06/Theater-in-Augsburg-Augsburger-Puppenkiste-Jim-Knopf-Und-Lukas-Der-Lokomotivfuhrer-Der-Prinz-Von-Pumpelonien-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a03a09a02a02a07/Papyrologie-Pergament-Palimpsest-Bucherverluste-in-Der-Spatantike-Oxyrhynchos-Papyrus-Papyrussammlung-Und-Papyrusmuseum-Wien-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/5a03a07a00a07a08/Polizeiliches-Handeln-Razzia-Fesselung-Verkehrsunfallaufnahme-Erkennungsdienstliche-Behandlung-Waffengebrauch-Der-Polizei-in-Deutschland-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a00a02a02a03a09/Ort-in-Osttimor-Ort-in-Aileu-Ort-in-Ainaro-Ort-in-Baucau-Ort-in-Bobonaro-Ort-in-Cova-Lima-Ort-in-DILI-Ort-in-Ermera-Ort-in-Lautem-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a01a03a01a02a00a09/Krankheitsbild-in-Der-Kinderchirurgie-Frenulum-Breve-Phimose-Darmverschluss-Siamesische-Zwillinge-Enuresis-Verbrennung-Hernie-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a05a09a06a05a01/Waldschutzgebiet-Liste-Der-Schutzgebiete-in-Baden-Wurttemberg-Urwald-Weisswasser-Bannwald-Nationalpark-Garajonay-Schutzwald-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a08a05a01a00a06/Anarchistische-Literatur-Erkenntnis-Fur-Freie-Menschen-Manifest-Der-Sechzehn-Gegenseitige-Hilfe-in-Der-Tier--Und-Menschenwelt-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/9a01a04a00a00a08/Seeschlacht-Erster-Weltkrieg-Seegefecht-Bei-Coronel-Unternehmen-Albion-Skagerrakschlacht-Vorstoss-in-Die-Rigaer-Bucht-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/1a00a03a02a09a04a02/Flutkatastrophe-Sturmflut-Sintflut-Hochwasser-in-Wurzburg-Hurrikan-Katrina-Uberschwemmungen-in-Queensland-2010-2011-by-Quelle-Wikipedia.pdfIn PDF document text
    • http://muicuiu.dumb1.com/6a07a08a06a02a01/Mobile-And-Wireless-Networks-Security-Proceedings-Of-The-Mwns-2008-Workshop-Singapore-9-April-2008-by-Maryline-Laurent-maknavicius.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.