Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c94d83faf7f252b…

MALICIOUS

PDF

19.5 KB Created: 2020-03-20 15:36:51 +00:00 Authoring application: mPDF 5.7
MD5: 8bfe2aee67834ea5fc254fd9c6b970aa SHA-1: f3cc1d14b272afa311d0c5952ddd1b464599534f SHA-256: 4c94d83faf7f252beb651a61b836a8b729de6d825cb788478a8c363153914750
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded links, many of which are to external PDF files hosted on the same domain. This suggests a link farm or redirection mechanism designed to lead users to potentially harmful content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ewasocmo.myhome.cx/3c37c39c34c33c35/We-Are-Your-Sons-The-Legacy-of-Ethel-and-Julius-Rosenberg-by-Michael-Meeropol.pdf
    • http://ewasocmo.myhome.cx/2c32c30c38c32c37/Killer-Weed-An-Ed-Rosenberg-Mystery-by-Michael-Castleman.pdf
    • http://ewasocmo.myhome.cx/1c30c38c39c33c30c31/Julius-Caesar-by-Michael-Grant.pdf
    • http://ewasocmo.myhome.cx/4c30c32c32c36c36/The-Assassination-of-Julius-Caesar-A-People-s-History-of-Ancient-Rome-by-Michael-Parenti.pdf
    • http://ewasocmo.myhome.cx/5c35c35c31c38c38/Kinship-of-Clover-by-Ellen-Meeropol.pdf
    • http://ewasocmo.myhome.cx/9c39c36c36c38c34/Julius-Zebra---Raufen-mit-den-R-mern-Die-Julius-Zebra-B-cher-1-by-Gary-Northfield.pdf
    • http://ewasocmo.myhome.cx/1c30c38c39c34c33c33/Julius-Zebra-Bundle-with-the-Britons-Julius-Zebra-2-by-Gary-Northfield.pdf
    • http://ewasocmo.myhome.cx/2c34c33c33c30c36/The-Legacy-Secrets-of-the-Shetlands-3-by-Michael-R-Phillips.pdf
    • http://ewasocmo.myhome.cx/7c38c35c33c39c33/Exchange-Rate-Determination-Models-and-Strategies-for-Exchange-Rate-Forecasting-by-Michael-Rosenberg.pdf
    • http://ewasocmo.myhome.cx/4c33c39c30c32/Hades-Disciples-The-Legacy-of-the-Gods-2-by-Michael-West.pdf
    • http://ewasocmo.myhome.cx/1c33c32c30c36c32/Zeus-Warriors-The-Legacy-of-the-Gods-3-by-Michael-West.pdf
    • http://ewasocmo.myhome.cx/1c32c32c37c32c39/Working-Effectively-with-Legacy-Code-by-Michael-C-Feathers.pdf
    • http://ewasocmo.myhome.cx/1c30c38c39c33c30c30/The-Complete-Works-of-Julius-Caesar-by-Gaius-Julius-Caesar.pdf
    • http://ewasocmo.myhome.cx/4c30c34c33c36c39/Universal-Studios-Monsters-A-Legacy-of-Horror-by-Michael-Mallory.pdf
    • http://ewasocmo.myhome.cx/5c38c34c33c35c35/The-Complete-Krondor-s-Sons-2-Book-Collection-Prince-of-the-Blood-The-King-s-Buccaneer-Krondor-s-Sons-1-2-by-Raymond-E-Feist.pdf
    • http://ewasocmo.myhome.cx/1c38c36c38c32c39/Midnight-Sons-Volume-3-Falling-for-Him-Ending-in-Marriage-Midnight-Sons-and-Daughters-by-Debbie-Macomber.pdf
    • http://ewasocmo.myhome.cx/1c31c30c36c38c38c33/Legacy-of-Glory-The-Bonaparte-Kingdom-of-Spain-1808-1813-by-Michael-Glover.pdf
    • http://ewasocmo.myhome.cx/2c35c30c39c34c35/The-Boy-Who-Runs-The-Odyssey-of-Julius-Achon-by-Julius-Achon.pdf
    • http://ewasocmo.myhome.cx/4c33c33c34c31c39/Tomlinson-Hill-Sons-of-Slaves-Sons-of-Slaveholders-by-Chris-Tomlinson.pdf
    • http://ewasocmo.myhome.cx/4c32c39c36c35c38/Lost-History-The-Enduring-Legacy-of-Muslim-Scientists-Thinkers-and-Artists-by-Michael-Hamilton-Morgan.pdf
    • http://ewasocmo.myhome.cx/

Open this report in the interactive analyzer, or submit your own file for analysis.