Malicious PDF — malware analysis report

Static analysis result for SHA-256 4bdc4f0c938c0b12…

MALICIOUS

PDF

16.6 KB Created: 2020-03-18 16:33:36 +00:00 Authoring application: mPDF 5.7
MD5: b81a3f11b3a7590b3ebb31a1298c6239 SHA-1: 6b71e1a03f8dcd2e4a0c3e84daffc64559082651 SHA-256: 4bdc4f0c938c0b121dbb24827d51a577b8f68f6ee8d6322bb8cddb492795009f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO abuse or to distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic confirms the presence of a link farm. No scripts were extracted from this sample, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9810

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ieuicufioao.myhome.cx/3557555555557559/White-Rose-Knight-Errant-3-by-R-Garcia-y-Robertson.pdf
    • http://ieuicufioao.myhome.cx/2554554555553550/White-Rose-by-R-Garcia-y-Robertson.pdf
    • http://ieuicufioao.myhome.cx/7558558552558555/Knight-Errant-Knight-Chronicles-1-by-Rue-Allyn.pdf
    • http://ieuicufioao.myhome.cx/3552552557558554/His-Faithful-Squire-Knight-Errant-2-by-K-D-Sarge.pdf
    • http://ieuicufioao.myhome.cx/7558558553558557/Knight-Errant-Highland-Passage-2-by-J-L-Jarvis.pdf
    • http://ieuicufioao.myhome.cx/3553559551553559/Star-Wars-Knight-Errant-Volume-3-Escape-by-John-Jackson-Miller.pdf
    • http://ieuicufioao.myhome.cx/1554554559552557/The-Clayborne-Brides-One-Pink-Rose-One-White-Rose-One-Red-Rose-by-Julie-Garwood.pdf
    • http://ieuicufioao.myhome.cx/4554553558558/White-Knight-Dom-Academy-2nd-Semester-White-Knight-Dom-Academy-3-by-Lucian-Bane.pdf
    • http://ieuicufioao.myhome.cx/3550558551557556/Batman-amp-Robin-Dark-Knight-vs-White-Knight-by-Paul-Cornell.pdf
    • http://ieuicufioao.myhome.cx/2552557553554551/White-Knight-White-3-by-Jaclyn-Reding.pdf
    • http://ieuicufioao.myhome.cx/2559550554555559/White-Light-by-Vanessa-Garcia.pdf
    • http://ieuicufioao.myhome.cx/1553550556554/Rose-Red-Rose-White-by-Marianne-Willman.pdf
    • http://ieuicufioao.myhome.cx/1556559552555556/One-White-Rose-Rose-3-by-Julie-Garwood.pdf
    • http://ieuicufioao.myhome.cx/1550557557558552/Final-Life-The-Transhuman-Chronicles-1-by-Rose-Garcia.pdf
    • http://ieuicufioao.myhome.cx/1558553550556/Tammy-Garcia-Form-without-Boundaries-by-Benjamin-Rose.pdf
    • http://ieuicufioao.myhome.cx/4557554556555552/The-White-Tree-The-Cycle-of-Arawn-Book-I-by-Edward-W-Robertson.pdf
    • http://ieuicufioao.myhome.cx/5551550557555551/Ghosts-of-the-Black-Rose-A-Catholic-and-a-Witch-Trilogy-2-by-Belinda-Vasquez-Garcia.pdf
    • http://ieuicufioao.myhome.cx/8558557554552556/Teri-by-J-Rose-Knight.pdf
    • http://ieuicufioao.myhome.cx/5551550554558/The-Rose-Knight-by-Anaiya-Sophia.pdf
    • http://ieuicufioao.myhome.cx/1551550554550554558/The-Soundtrack-of-Rose-by-Knight-39-s-Realm.pdf
    • http://ieuicufioao.myhome.cx/3550558551557556/Batman-amp-Robin-Dark-Knight-vs-White-Knight

Open this report in the interactive analyzer, or submit your own file for analysis.