Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b00765c08416a19…

MALICIOUS

PDF

16.0 KB Created: 2020-03-18 21:08:07 +00:00 Authoring application: mPDF 5.7
MD5: a3d986cab568a88334e07cc54d7d1cf1 SHA-1: 834e754b78c59546b43993b3608401d6603fb10b SHA-256: 4b00765c08416a19a0d3523a2889eb4f85475452c68aab2a9fe45c93481e57f4
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically identified this pattern, and the ML classifier strongly indicated maliciousness. The primary attack pattern involves directing users to a large collection of documents hosted on the suspicious domain 'kitasdyu.myhome.cx'.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kitasdyu.myhome.cx/1871878871870878/The-Ascension-My-Name-is-Aelida-1-by-J-C-McGuire.pdf
    • http://kitasdyu.myhome.cx/1872873876878876/The-Gloaming-My-Name-is-Aelida-2-by-J-C-McGuire.pdf
    • http://kitasdyu.myhome.cx/5871872877874/Ascension-An-Analysis-of-the-Art-of-Ascension-as-Taught-by-the-Ishayas-by-Maharishi-Sadasiva-Isham.pdf
    • http://kitasdyu.myhome.cx/4870876876872874/Ascension-An-Analysis-of-the-Art-of-Ascension-as-Taught-by-the-Ishayas-by-Maharishi-Sadasiva-Isham.pdf
    • http://kitasdyu.myhome.cx/1873874876873879/The-Darkening-Guardians-of-Ascension-6-5-Dawn-of-Ascension-2-by-Caris-Roane.pdf
    • http://kitasdyu.myhome.cx/3874875878871876/Ascension-by-J-S-Barrett.pdf
    • http://kitasdyu.myhome.cx/7873873875873872/L-Ascension-du-Haut-Mal-by-David-B-.pdf
    • http://kitasdyu.myhome.cx/1876872873870873/Ascension-The-End-Game-by-A-P-West.pdf
    • http://kitasdyu.myhome.cx/2879877878878873/The-Society-Ascension-4-by-K-A-Linde.pdf
    • http://kitasdyu.myhome.cx/3877879870879878/The-Affiliate-Ascension-1-by-K-A-Linde.pdf
    • http://kitasdyu.myhome.cx/2878870873875/Ascension-by-Giovanni-Singleton.pdf
    • http://kitasdyu.myhome.cx/3873872879870874/Ascension-The-Circle-War-3-by-Matt-King.pdf
    • http://kitasdyu.myhome.cx/1871879876874876/Sacrificed-in-Shadow-Ascension-1-by-S-M-Reine.pdf
    • http://kitasdyu.myhome.cx/1872875870878877/Oaths-of-Blood-Ascension-2-by-S-M-Reine.pdf
    • http://kitasdyu.myhome.cx/1876872870873875/Highvern-Ascension-by-Brett-Walker.pdf
    • http://kitasdyu.myhome.cx/1879873871879870/Ms-Marvel-Vol-6-Ascension-by-Brian-Reed.pdf
    • http://kitasdyu.myhome.cx/1872879873875877/Lost-in-Prophecy-Ascension-5-by-S-M-Reine.pdf
    • http://kitasdyu.myhome.cx/7870870875877876/Prediction-Ascension-7-by-Lynn-Leite.pdf
    • http://kitasdyu.myhome.cx/1875878876874870/The-Ascension-The-Wordwick-Games-2-by-Kailin-Gow.pdf
    • http://kitasdyu.myhome.cx/4879870871870879/The-Well-of-Ascension-Mistborn-2-by-Brandon-Sanderson.pdf
    • http://kitasdyu.myhome.cx/187

Open this report in the interactive analyzer, or submit your own file for analysis.