Malicious PDF — malware analysis report

Static analysis result for SHA-256 43e1fa7bf192e0fd…

MALICIOUS

PDF

17.1 KB Created: 2019-05-02 08:26:05 +01:00 Authoring application: mPDF 5.7
MD5: b02f6bd6ac008685e3a79f83569f9ff5 SHA-1: 7d67d3db5823c41f7ff85eff03eacb8384a32e4f SHA-256: 43e1fa7bf192e0fd525e4160ea77831b0968a3603322179190aa3577fe0e327d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a PDF_SEO_LINK_FARM heuristic firing, indicating the presence of a large number of embedded external links. These links, such as http://cmeinasaoo.duckdns.org/8b27b29b28b28b25/-Sammelband-Abrichtung-der-Zwillinge-3-by-Lisa-Zuch.pdf, are likely used to direct users to malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/8b27b29b28b28b25/-Sammelband-Abrichtung-der-Zwillinge-3-by-Lisa-Zuch.pdf
    • http://cmeinasaoo.duckdns.org/9b27b20b23b27b22/-SAMMELBAND-Das-Freudenhaus-3-by-Lisa-Leuchten.pdf
    • http://cmeinasaoo.duckdns.org/6b25b24b21b22b22/-SAMMELBAND-Reif-und-Unterw-rfig-2-by-Lisa-Leuchten.pdf
    • http://cmeinasaoo.duckdns.org/8b26b21b24b27b20/Abrichtung-einer-Praktikantin---BDSM-SEX-by-Jeko-Lorenz.pdf
    • http://cmeinasaoo.duckdns.org/8b26b29b20b25b25/Seelenw-chter---Die-Zwillinge-by-Nathan-Jaeger.pdf
    • http://cmeinasaoo.duckdns.org/8b27b29b28b22b21/Zwillinge-in-Dur-und-Moll-by-Brigitte-Teufl-Heimhilcher.pdf
    • http://cmeinasaoo.duckdns.org/1b21b24b22b28b29b24/Das-goldene-Pendel-von-Dangholt-Zwillinge-in-Gefahr-by-Thomas-Wiens.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b21b22b20b28/Krankheitsbild-in-Der-Chirurgie-Siamesische-Zwillinge-Abszess-Furunkel-Karbunkel-Wunde-Struma-Karpaltunnelsyndrom-Aneurysma-by-Quelle-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/8b27b29b27b22b28/Mit-dem-falschen-Bruder-im-Bett-Romane-ber-die-Dalton-Zwillinge-Dalton-Brothers-1-by-Virna-DePaul.pdf
    • http://cmeinasaoo.duckdns.org/1b20b26b27b22b25b25/Sammelband-Band-1---4-by-Johanna-Wasser.pdf
    • http://cmeinasaoo.duckdns.org/6b25b24b22b20b21/Pflaume-so-reif-XXL-Sammelband-10-Kurzgeschichten-by-Ann-Bussel.pdf
    • http://cmeinasaoo.duckdns.org/6b25b24b20b29b26/Reif-und-Ungezogen-3---Sammelband-by-Lara-Niebel.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b22b27b23b24/-SAMMELBAND-Schmutzige-Benutzung-by-Katie-Karlaga.pdf
    • http://cmeinasaoo.duckdns.org/1b20b29b26b29b23b22/Feuerwerk-der-L-ste---Sammelband-3-by-Vivian-Gold.pdf
    • http://cmeinasaoo.duckdns.org/1b20b20b20b22b21b27/Elben-und-Zwerge-Sammelband-by-Alfred-Bekker.pdf
    • http://cmeinasaoo.duckdns.org/9b25b26b20b27b26/Falkengrund-Sammelband-12---14-Schattent-nzer-by-Martin-Clau-.pdf
    • http://cmeinasaoo.duckdns.org/1b21b27b28b21b28b24/Von-Null-auf-Liebe---Sammelband-Teil-1---3-by-Andrea-Bielfeldt.pdf
    • http://cmeinasaoo.duckdns.org/1b21b25b28b21b28b26/Geschichten-von-der-kleinen-Eule-Sammelband-by-Karla-Hettesheimer.pdf
    • http://cmeinasaoo.duckdns.org/1b20b25b23b28b24b21/Gischtgeboren---Sammelband-2-Magie-der-Meerjungfrau-by-Laird-Oliver.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b22b28b26b25/-SAMMELBAND-Schmutzige-BDSM-Fotzen-3-by-Lara-Niebel.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b21b22b20b28/Krankheitsbild-in-Der-Chirurgie-Siamesische-Zwillinge-Abszess-Furunkel-Karbunkel-Wunde-Struma-Karpaltunnelsyndrom-Aneurysma-by-Quelle-Wikipedia