Malicious PDF — malware analysis report

Static analysis result for SHA-256 4b579f3b50ce3802…

MALICIOUS

PDF

25.5 KB Created: 2019-05-01 19:44:20 +01:00 Authoring application: mPDF 5.7
MD5: 6246a1c9f2dd1541fa5403f63568b052 SHA-1: 38188e0f332bf457c9c339c4b959392584957167 SHA-256: 4b579f3b50ce38027b83ad87dfb7729e02a9ff172f039eab96e89b63dcf53e1d
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. While most of these links point to benign-looking academic papers, the sheer volume and the ML_NYX_PDF_MALICIOUS classification suggest a malicious intent, likely to manipulate search engine rankings or to serve as a distribution point for further malicious content. The embedded URLs are the primary IOCs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/8b25b28b27b24/Review-of-Verbal-Behavior-Reprint-Series-in-Social-Science-by-B-F-Skinner.pdf
    • http://cmeinasaoo.duckdns.org/4b27b24b28b24b27/Verbal-Behavior-by-B-F-Skinner.pdf
    • http://cmeinasaoo.duckdns.org/3b27b27b25b26b20/Science-and-Human-Behavior-by-B-F-Skinner.pdf
    • http://cmeinasaoo.duckdns.org/1b21b24b23b29b23b21/Psychologisches-Werk-Das-Ich-Und-Das-Es-Verbal-Behavior-Das-Unbehagen-in-Der-Kultur-Totem-Und-Tabu-by-Quelle-Wikipedia.pdf
    • http://cmeinasaoo.duckdns.org/8b25b24b21b25/Psychotherapist-s-Casebook-Theory-and-Techniques-in-the-Practice-of-Modern-Therapies-Jossey-Bass-Social-and-Behavioral-Science-Series-by-Irwin-L-Kutash.pdf
    • http://cmeinasaoo.duckdns.org/7b28b29b22b22b27/A-Reprint-from-the-social-contract-The-Camp-Of-The-Saints-Vol-V-No-2-Winter-1994-1995-by-Jean-Raspail.pdf
    • http://cmeinasaoo.duckdns.org/6b25b20b21b21b25/Religion-Personality-and-Social-Behavior-by-Vassilis-Saroglou.pdf
    • http://cmeinasaoo.duckdns.org/9b23b23b28b27b24/Hormones-Drugs-and-Social-Behavior-in-Primates-by-A-S-Kling.pdf
    • http://cmeinasaoo.duckdns.org/9b29b25b23b23b26/Doing-a-Literature-Review-in-Health-and-Social-Care-A-Practical-Guide-by-Helen-Aveyard.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b24b26b26b27/Fostering-Sustainable-Behavior-An-Introduction-to-Community-Based-Social-Marketing-by-Doug-McKenzie-Mohr.pdf
    • http://cmeinasaoo.duckdns.org/5b23b24b26b26b22/Reviews-On-Corrosion-Inhibitors-Science-And-Technology-Papers-Presented-At-The-Corrosion-89-Symposium-quot-Review-Of-Corrosion-Inhibition-Science-quot-Sponsored-Group-T-3-A-15-N-Inhibitors-State-Of-The-A-by-Paul-Labine.pdf
    • http://cmeinasaoo.duckdns.org/5b24b29b27b20b23/Pretexts-Reflections-on-literature-and-morality-Essay-index-reprint-series-by-Andr-Gide.pdf
    • http://cmeinasaoo.duckdns.org/8b26b20b26b21b20/Los-Angeles-Review-of-Books---Digital-Editions-Science-Fiction-by-Gerry-Canavan.pdf
    • http://cmeinasaoo.duckdns.org/1b25b27b23b29/Science-Philosophy-and-Human-Behavior-in-the-Soviet-Union-by-Loren-R-Graham.pdf
    • http://cmeinasaoo.duckdns.org/6b26b20b29b29b25/Lyrical-Ballads-Reprinted-from-the-First-Edition-of-1798-1890-Legacy-Reprint-Series-by-William-Wordsworth.pdf
    • http://cmeinasaoo.duckdns.org/6b27b26b23b25b29/Agriculture-at-the-Border-Canada-Us-Trade-Relations-in-the-Global-Food-Regime-Canadian-Plains-Reprint-Series-by-GREGORY-MARCHILDON.pdf
    • http://cmeinasaoo.duckdns.org/9b22b26b23b21b20/Social-Intelligence-The-New-Science-of-Success-by-Karl-Albrecht.pdf
    • http://cmeinasaoo.duckdns.org/1b20b26b23b20b20b23/Inferno-by-Dan-Brown-Book-Review-Robert-Langdon-Series-by-Laura-Leblanc.pdf
    • http://cmeinasaoo.duckdns.org/8b24b20b29b22b27/World-Scientific-Series-on-Nonlinear-Science-Series-A-Volume-16-Turbulence-Strange-Attractors-and-Chaos-by-David-Ruelle.pdf
    • http://cmeinasaoo.duckdns.org/1b21b22b20b26b24b20/How-Does-Social-Science-Work-Reflections-on-Practice-by-Paul-Diesing.pdf
    • http://cmeinasaoo.duckdns.org/8b25b24b21b25/Psychotherapist-s-Casebook-Theory-and-Techniques-in-the-Practice-of-Modern-Therapies-Jossey-Ba

Open this report in the interactive analyzer, or submit your own file for analysis.