Malicious PDF — malware analysis report

Static analysis result for SHA-256 416d36b436ea3cf8…

MALICIOUS

PDF

18.7 KB Created: 2019-04-30 05:50:09 +01:00 Authoring application: mPDF 5.7
MD5: d357224305686f5f159c7c281ead5d76 SHA-1: cc1acb1dedb74e1fe91bc3e2a36ae86a92845b56 SHA-256: 416d36b436ea3cf8aad440bb14f9e8e1ab926f9193ce888994508ce84c6b1a6c
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF document contains a large number of embedded links to external PDFs hosted on the domain 'muicuiu.dumb1.com'. This behavior is indicative of a link farm or a redirection scheme designed to lead users to potentially malicious content. The ML classifier strongly supports the malicious verdict, and the PDF_SEO_LINK_FARM heuristic confirms the suspicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a04a04a05a02a04/Sahara-A-Natural-History-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/6a02a01a01a08a09/Timbuktu-The-Sahara-s-Fabled-City-of-Gold-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/6a02a01a01a09a00/The-End-Natural-Disasters-Manmade-Catastrophes-and-the-Future-of-Human-Survival-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/3a04a01a00a07a00/Back-to-the-Well-Rethinking-the-Future-of-Water-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/5a05a06a01a02/Water-The-Fate-of-Our-Most-Precious-Resource-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/6a02a01a03a03a03/The-Heartbreak-Grape-A-California-Winemaker-s-Search-for-the-Perfect-Pinot-Noir-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/1a09a07a06a07a05/White-Tribe-Dreaming-Apartheid-s-Bitter-Roots-as-Witnessed-8-Generations-Afrikaner-Family-by-Marq-de-Villiers.pdf
    • http://muicuiu.dumb1.com/6a02a01a01a07a08/Great-Villiers-A-Study-of-George-Villiers-Second-Duke-of-Buckingham-1628-1687-by-Hester-W-Chapman.pdf
    • http://muicuiu.dumb1.com/6a03a03a05a01/Dialogues-Concerning-Natural-Religion-and-The-Natural-History-of-Religion-by-David-Hume.pdf
    • http://muicuiu.dumb1.com/1a03a08a05a02a00/Natural-Right-and-History-by-Leo-Strauss.pdf
    • http://muicuiu.dumb1.com/8a06a02a08a08/On-the-Natural-History-of-Destruction-by-W-G-Sebald.pdf
    • http://muicuiu.dumb1.com/2a05a00a06a07a00/Why-We-Run-A-Natural-History-by-Bernd-Heinrich.pdf
    • http://muicuiu.dumb1.com/4a07a01a04a01a09/A-Natural-History-of-Wine-by-Ian-Tattersall.pdf
    • http://muicuiu.dumb1.com/8a08a08a05a06a03/Why-We-Run-A-Natural-History-by-Bernd-Heinrich.pdf
    • http://muicuiu.dumb1.com/4a04a07a06a03a08/The-Natural-History-of-Canterbury-by-Michael-Winterbourn.pdf
    • http://muicuiu.dumb1.com/1a08a08a00a05a02/Natural-History-of-New-York-by-John-Kieran.pdf
    • http://muicuiu.dumb1.com/6a09a00a02a07a03/The-Natural-History-of-Unicorns-by-Chris-Lavers.pdf
    • http://muicuiu.dumb1.com/6a09a07a05a05a08/Walking-with-Dinosaurs-A-Natural-History-by-Tim-Haines.pdf
    • http://muicuiu.dumb1.com/3a09a06a00a08a01/Natural-History-A-Selection-by-Pliny-the-Elder.pdf
    • http://muicuiu.dumb1.com/1a01a02a00a05a07/The-Gal-pagos-A-Natural-History-by-Henry-Nicholls.pdf
    • http://muicuiu.dumb1.com/6a02a01

Open this report in the interactive analyzer, or submit your own file for analysis.