Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e189e15110a3214…

MALICIOUS

PDF

14.7 KB Created: 2020-03-18 11:20:53 +00:00 Authoring application: mPDF 5.7
MD5: d7fabd61f11f7fd94ceb2ea966419f4d SHA-1: 7970fd0dc46face8c5869e0ef6958cf8a0dea8b5 SHA-256: 4e189e15110a32148d545ac7d521929e992fe8b39e50e072f94bfc32320b0d45
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs point to a domain that appears to be used for distributing content, potentially malicious, under the guise of book titles. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9798

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://easckaolp.myhome.cx/1841840847841848846/The-Man-of-My-Life-by-Manuel-V-zquez-Montalb-n.pdf
    • http://easckaolp.myhome.cx/1840847848840841845/Wander-Reiten-um-die-Welt-Oskar-reitet-in-Indien-Tibet-China-T-rkei-Nord-und-S-damerika-by-Manuel-Sauda-Sauda-Manuel.pdf
    • http://easckaolp.myhome.cx/9846847845844840/Conversations-with-Manuel-Castells-by-Manuel-Castells.pdf
    • http://easckaolp.myhome.cx/5844841844841848/Chaos-by-Manuel-Almendro.pdf
    • http://easckaolp.myhome.cx/1841843847848843849/Die-Totenfresser-by-Niklaus-Manuel.pdf
    • http://easckaolp.myhome.cx/3843849843845848/Kanyakumari-by-Hazel-Manuel.pdf
    • http://easckaolp.myhome.cx/1848846846842842/Insecten-in-plastic-by-Manuel-van-Loggem.pdf
    • http://easckaolp.myhome.cx/1840840846840848840/Strenge-Erziehung-by-Manuel-Magiera.pdf
    • http://easckaolp.myhome.cx/3846846840846846/The-Geranium-Woman-by-Hazel-Manuel.pdf
    • http://easckaolp.myhome.cx/9846847847842845/Manuel-Castells-by-Jesse-Russell.pdf
    • http://easckaolp.myhome.cx/6848841844845842/Zigzagger-Stories-by-Manuel-Mu-oz.pdf
    • http://easckaolp.myhome.cx/3841846849842840/Killer-Protocols-by-David-E-Manuel.pdf
    • http://easckaolp.myhome.cx/4849842843843847/The-Carpenter-s-Pencil-by-Manuel-Rivas.pdf
    • http://easckaolp.myhome.cx/4845848847849/Four-Spanish-Pieces-by-Manuel-de-Falla.pdf
    • http://easckaolp.myhome.cx/3844849843843843/The-Killer-Trees-by-David-E-Manuel.pdf
    • http://easckaolp.myhome.cx/9846847847842846/Manuel-Castells-by-Frank-Webster.pdf
    • http://easckaolp.myhome.cx/7841842843840849/Manuel-Gallego-by-Erica-Witschey.pdf
    • http://easckaolp.myhome.cx/6842841844849840/So-ador-by-Manuel-Angel-Arrias.pdf
    • http://easckaolp.myhome.cx/5840849846844841/-Qu-me-quieres-amor-by-Manuel-Rivas.pdf
    • http://easckaolp.myhome.cx/1846842849840848/Jacob-s-ladder-by-Manuel-Alfonseca.pdf
    • http://easckaolp.myhome.cx/384

Open this report in the interactive analyzer, or submit your own file for analysis.