PDF static analysis report

Static analysis result for SHA-256 43e11def14b6a4d7…

SUSPICIOUS

PDF

16.0 KB Created: 2019-05-02 02:21:08 +01:00 Authoring application: mPDF 5.7 First seen: 2020-01-07
MD5: 29fea45a455fff332576082c45a04075 SHA-1: 8c68b12406ab3b6c1776c232267814c97e7cbf40 SHA-256: 43e11def14b6a4d7cba868d514388898d7718484f35c2d279af5e1b0fbf7fce5
34 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The ML classifier strongly indicates maliciousness. The document contains numerous embedded URLs pointing to external PDF files, disguised as free Shakespearean literature. This suggests a social engineering lure to trick users into downloading further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/5f214f211f210f212f213/A-Midsummer-Night-s-Dream-By-William-Shakespeare---Illustrated-Comes-with-a-Free-Audiobook-by-William-Shakespeare.pdf PDF link annotation
    • http://kiteeearpdf.myhome.cx/5f213f218f217f210f215/A-New-Variorum-Edition-of-Shakespeare-Midsummer-Night-s-Dream-1895-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/8f211f217f211f213f211/A-Midsummer-Night-s-Dream-The-Shorter-Shakespeare-Series-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/9f215f213f210f216f215/The-Shakespeare-Plays-A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/7f210f214f213f219f212/A-Midsummer-Night-s-Dream-By-William-Shakespeare---Illustrated-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/5f214f211f216f215f214/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/3f214f217f212f217f219/Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/3f213f218f212f211f216/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/5f217f214f211f218f217/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/3f213f214f210f219f219/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/1f211f210f215f217f210f215/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/1f210f216f214f217f212f212/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/5f217f215f210f211f213/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/7f215f214f218f211f213/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/4f217f210f216f214f215/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/6f219f217f213f211/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/6f211f215f219f217f215/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/7f213f216f217f211f215/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/1f210f212f214f214f217f210/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text
    • http://kiteeearpdf.myhome.cx/8f213f219f217f217f216/A-Midsummer-Night-s-Dream-by-William-Shakespeare.pdfIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Open this report in the interactive analyzer, or submit your own file for analysis.