Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ae297ec8b6c0b48…

MALICIOUS

PDF

18.2 KB Created: 2020-03-18 09:34:54 +00:00 Authoring application: mPDF 5.7
MD5: 23af680ff77ad5fc42c3a3e6a69ac945 SHA-1: 88928c745c583a1a5a7077841eaf5e4df37f89fb SHA-256: 4ae297ec8b6c0b48f487e2d7eecbedae84884adf1762a6d04c6ecdbc233b86f4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links pointing to external PDF files hosted on a dynamic DNS domain. This behavior is indicative of a link farm or redirection scheme designed to lead users to potentially malicious content. The ML classifier strongly supports the malicious verdict.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reiteaspdf.dyndns.co.za/49fa89fa59fa29fa39fa2/And-Only-to-Deceive-Lady-Emily-Series-1-by-Tasha-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/29fa79fa69fa89fa09fa1/And-Only-to-Deceive-A-Novel-of-Suspense-Lady-Emily-1-by-Tasha-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/19fa49fa99fa19fa49fa0/A-Poisoned-Season-Lady-Emily-2-by-Tasha-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/59fa49fa29fa89fa89fa9/The-Counterfeit-Heiress-Lady-Emily-9-by-Tasha-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/39fa59fa19fa89fa19fa1/Uneasy-Lies-the-Crown-Lady-Emily-13-by-Tasha-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/99fa39fa39fa3/The-Lady-Travelers-Guide-to-Deception-with-an-Unlikely-Earl-The-Lady-Travelers-Society-3-by-Victoria-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/89fa19fa99fa69fa3/Lady-in-White-Lady-Series-2-by-Denise-Domning.pdf
    • http://reiteaspdf.dyndns.co.za/79fa59fa09fa59fa3/The-Complete-Emily-Starr-Trilogy-Emily-of-New-Moon-Emily-Climbs-Emily-s-Quest-by-L-M-Montgomery.pdf
    • http://reiteaspdf.dyndns.co.za/49fa49fa49fa69fa09fa7/His-Boss-Lady-by-Emily-Walker.pdf
    • http://reiteaspdf.dyndns.co.za/29fa09fa69fa79fa3/What-A-Lady-Wants-Last-Man-Standing-2-by-Victoria-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/39fa99fa79fa89fa49fa6/Lady-Emily-s-Escape-House-of-Catesby-1-by-Sunny-Brooks.pdf
    • http://reiteaspdf.dyndns.co.za/39fa99fa49fa39fa59fa0/The-Lady-in-Question-Effingtons-7-by-Victoria-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/29fa39fa09fa19fa49fa6/Secrets-of-a-Proper-Lady-Last-Man-Standing-3-by-Victoria-Alexander.pdf
    • http://reiteaspdf.dyndns.co.za/49fa09fa89fa59fa19fa5/To-Deceive-a-Duke-by-Amanda-McCabe.pdf
    • http://reiteaspdf.dyndns.co.za/19fa79fa09fa29fa89fa6/The-Passion-Series-by-Emily-Jane-Trent.pdf
    • http://reiteaspdf.dyndns.co.za/39fa69fa59fa39fa79fa4/Never-Deceive-a-Duke-Neville-Family-2-by-Liz-Carlyle.pdf
    • http://reiteaspdf.dyndns.co.za/49fa99fa99fa29fa29fa3/If-You-Deceive-MacCarrick-Brothers-3-by-Kresley-Cole.pdf
    • http://reiteaspdf.dyndns.co.za/39fa69fa99fa09fa69fa0/Collecting-the-Constellations-The-Antiquities-Series-1-by-Emily-Steers.pdf
    • http://reiteaspdf.dyndns.co.za/99fa49fa99fa69fa29fa6/Emily-s-Wish-Prossers-Bay-Series-Book-4-by-Cheryl-Phipps.pdf
    • http://reiteaspdf.dyndns.co.za/19fa19fa69fa79fa19fa49fa2/A-Bite-Is-Forever-Part-1-Everlasting-Night-Series-Everlasting-Night-Series-by-Scott-Alexander-Baker.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.