Malicious PDF — malware analysis report

Static analysis result for SHA-256 5009aa0e171999b2…

MALICIOUS

PDF

22.4 KB Created: 2019-05-09 00:19:34 +01:00 Authoring application: mPDF 5.7
MD5: 3a85c9b1064d89f446a3b95c8632ad13 SHA-1: 873ce0b4c83057f21b6c40a32e990372a60d78de SHA-256: 5009aa0e171999b23680492219cfedb3b958fd13256645dcade78b36e1488f47
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier also flagged this PDF as malicious with a high probability. The URLs point to a domain that appears to be hosting a link farm, likely intended to drive traffic or distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9726

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/8a08a06a09a01a07/A-Study-Guide-for-Laurie-Halse-Anderson-s-quot-Fever-1793-quot-Novels-for-Students-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/5a02a08a03a04a05/A-Study-Guide-for-E-H-Gombrich-s-quot-Art-and-Illusion-A-Study-in-the-Psychology-of-Pictorial-Representation-quot-Nonfiction-Classics-for-Students-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/1a01a00a04a03a01a02/A-Study-Guide-for-William-Strunk-Jr-E-B-White-s-quot-Elements-of-Style-quot-Nonfiction-Classics-for-Students-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/6a01a07a04a06a05/A-Study-Guide-for-Anna-Akhmatova-s-quot-Requiem-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/8a03a09a00a02a07/A-Study-Guide-for-Selma-Lagerlof-s-quot-the-Outlaws-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/7a04a00a07a01a04/A-Study-Guide-for-Aleksandar-Hemon-s-quot-islands-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/6a01a07a04a09a02/A-Study-Guide-for-Anna-Akhmatova-s-quot-Voronezh-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/7a05a03a05a01a07/A-Study-Guide-for-Edwidge-Danticat-s-quot-Children-of-the-Sea-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/1a01a07a01a01a02a05/A-Study-Guide-for-Ketti-Frings-s-quot-Look-Homeward-Angel-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/1a01a06a08a08a01a00/A-Study-Guide-for-Tamora-Pierce-s-quot-Trickster-s-choice-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/7a05a03a04a04a02/A-Study-Guide-for-Edwidge-Danticat-s-quot-the-Farming-of-Bones-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/8a05a02a05a06a08/A-Study-Guide-for-Anthony-Doerr-s-quot-the-Shell-Collector-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/9a00a09a05a05a01/A-Study-Guide-for-T-Coraghessan-Boyle-s-quot-the-Underground-Gardens-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/1a01a00a05a09a09a09/A-Study-Guide-for-Audrey-Niffenegger-s-quot-The-Time-Traveler-s-Wife-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/1a00a06a01a05a09a06/A-Study-Guide-for-Mark-Hollmann-Greg-Kotis-s-quot-Urinetown-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/8a03a05a08a04a01/A-Study-Guide-for-Jean-M-Auel-s-quot-the-Clan-of-the-Cave-Bear-quot-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/7a00a07a08a06a00/A-Study-Guide-for-Marcus-Zusak-s-quot-The-Book-Thief-quot-Novels-for-Students-by-The-Gale-Group.pdf
    • http://muicuiu.dumb1.com/7a05a03a03a09a04/A-Study-Guide-for-Danticat-s-Brother-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/9a09a00a02a00a00/A-Study-Guide-for-Jeffrey-Eugenides-s-Middlesex-by-Cengage-Learning-Gale.pdf
    • http://muicuiu.dumb1.com/8a03a05a08a06a04/A-Study-Guide-for-Jean-M-Auel-s-quot-The-Clan-of-the-Cave-Bear-quot-by-Gale.pdf
    • http://muicuiu.dumb1.com/7a04a00a07a01a

Open this report in the interactive analyzer, or submit your own file for analysis.