Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e1f094e8930821a…

MALICIOUS

PDF

22.6 KB Created: 2019-05-02 01:17:21 +01:00 Authoring application: mPDF 5.7
MD5: f8cff5b9161741c5b76f69b8a3891a59 SHA-1: 7da5033e736b64b1b464f7d5a8490b9a9fabe306 SHA-256: 4e1f094e8930821a183ec382c699a787ff448012919bbcb47036fecc1c3dc999
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded external links, characteristic of a link farm or a phishing lure. While the specific content of the links appears benign, the sheer volume and structure suggest a malicious intent to redirect users. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9901

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a08a00a06/Tears-We-Cannot-Stop-A-Sermon-to-White-America-by-Michael-Eric-Dyson.pdf
    • http://muicuiu.dumb1.com/2a05a03a04a05a01/Tears-We-Cannot-Stop-A-Sermon-to-White-America-by-Michael-Eric-Dyson.pdf
    • http://muicuiu.dumb1.com/2a08a05a05a08a08/April-4-1968-Martin-Luther-King-Jr-s-Death-and-How-It-Changed-America-by-Michael-Eric-Dyson.pdf
    • http://muicuiu.dumb1.com/3a03a01a05a02/Come-Hell-Or-High-Water-Hurricane-Katrina-And-The-Color-Of-Disaster-by-Michael-Eric-Dyson.pdf
    • http://muicuiu.dumb1.com/4a04a01a09a09a00/Men-s-Work-How-to-Stop-the-Violence-That-Tears-Our-Lives-Apart-by-Paul-Kivel.pdf
    • http://muicuiu.dumb1.com/3a02a01a04a05a08/STOP-21-Stops-to-Reduce-Stress-and-Enhance-Joy-by-Eric-Parmenter.pdf
    • http://muicuiu.dumb1.com/6a04a00a07a03a04/The-Life-and-Times-of-Jesus-From-His-Earthly-Beginnings-to-the-Sermon-on-the-Mount-Part-I-by-Michael-J-Ruszala.pdf
    • http://muicuiu.dumb1.com/8a05a04a03a09a00/The-Woman-in-White-In-One-Moment-Every-Drop-of-Blood-in-My-Body-Was-Brought-to-a-Stop-There-as-If-It-Had-That-Moment-Sprung-Out-of-the-Earth-Stood-the-Figure-of-a-Solitary-Woman-Dressed-from-Head-to-Foot-in-White-by-Wilkie-Collins.pdf
    • http://muicuiu.dumb1.com/5a02a00a07/White-Tears-by-Hari-Kunzru.pdf
    • http://muicuiu.dumb1.com/6a00a06a06a08/Tears-For-My-City-An-Autobiography-of-a-Detroit-White-Boy-by-Dean-Dimitrieski.pdf
    • http://muicuiu.dumb1.com/3a09a03a05a00a04/Tears-of-a-Clown-Glenn-Beck-and-the-Tea-Bagging-of-America-by-Dana-Milbank.pdf
    • http://muicuiu.dumb1.com/3a04a03a08a01a01/Tears-for-Hesh-by-J-Michael-Radcliffe.pdf
    • http://muicuiu.dumb1.com/1a01a06a04a00a03a02/Iron-William-and-the-Carpenter-s-Tears-by-Michael-Gardner.pdf
    • http://muicuiu.dumb1.com/3a01a08a08a09a07/Black-and-White-by-Eric-Walters.pdf
    • http://muicuiu.dumb1.com/2a09a02a06/Living-Forward-A-Proven-Plan-to-Stop-Drifting-and-Get-the-Life-You-Want-by-Michael-Hyatt.pdf
    • http://muicuiu.dumb1.com/2a02a00a04a00a06/White-Technologies-by-Eric-Patrick-Clayton.pdf
    • http://muicuiu.dumb1.com/6a00a01a06a04a01/Marquise-Marie-Brinvilliers-Serial-Killer-Bus-Stop-Reads-4-by-Bus-Stop-Guides.pdf
    • http://muicuiu.dumb1.com/1a08a02a04a00/Leviathan-The-History-of-Whaling-in-America-by-Eric-Jay-Dolin.pdf
    • http://muicuiu.dumb1.com/2a05a05a04a05a08/America-s-Reconstruction-People-and-Politics-After-the-Civil-War-by-Eric-Foner.pdf
    • http://muicuiu.dumb1.com/2a05a07a02a06a06/The-Nazis-Next-Door-How-America-Became-a-Safe-Haven-for-Hitler-s-Men-by-Eric-Lichtblau.pdf