Malicious PDF — malware analysis report

Static analysis result for SHA-256 52e6e7540479a9c4…

MALICIOUS

PDF

16.5 KB Created: 2020-03-10 11:27:01 +00:00 Authoring application: mPDF 5.7
MD5: 8368353909361d76c888c0e99ade0930 SHA-1: 704579a274a51abec824c7e16dcadfab9f8bb582 SHA-256: 52e6e7540479a9c4f0596ec5e8ad2ae6560c1c1322e2d5b4cc12c565c96b0357
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by a machine learning classifier and contains a large number of external links, indicative of a link farm. The primary purpose appears to be directing users to various book-related PDFs hosted on the ujcsiniio.myhome.cx domain. This technique is often used for SEO poisoning or to distribute malicious content disguised as legitimate files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9898

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ujcsiniio.myhome.cx/4cd2cd4cd1cd1/The-Sword-of-Truth-Boxed-Set-II-Temple-of-the-Winds-Soul-of-the-Fire-Faith-of-the-Fallen-Sword-of-Truth-4-6-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/4cd0cd8cd7cd3cd7/Soul-of-the-Fire-Sword-of-Truth-5-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/4cd2cd4cd1cd0/The-Sword-of-Truth-Boxed-Set-III-The-Pillars-of-Creation-Naked-Empire-Chainfire-Sword-Of-Truth-7-9-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/3cd5cd2cd0cd2/Chainfire-Sword-of-Truth-9-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/3cd3cd8cd3cd6/Temple-of-the-Winds-Sword-of-Truth-4-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/2cd6cd7cd6cd2/Wizard-s-First-Rule-Sword-of-Truth-1-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/2cd3cd3cd5cd6cd2/Blood-of-the-Fold-Sword-of-Truth-3-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/8cd9cd4cd9cd9cd1/De-derde-wet-van-de-magie-Sword-of-Truth-3-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/8cd9cd4cd9cd2cd0/De-tweede-wet-van-de-magie-Sword-of-Truth-2-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/4cd9cd6cd2cd2cd1/Stone-of-Tears-Sword-of-Truth-2-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/1cd9cd6cd1cd6cd3/Temple-of-the-Winds-Sword-of-Truth-4-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/4cd5cd2cd6/Nest-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/1cd0cd4cd2cd4/The-First-Confessor-The-Legend-of-Magda-Searus-1-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/6cd2cd5cd1cd3cd6/Le-fant-me-du-souvenir-L-Ep-e-de-V-rit-10-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/5cd4cd3cd5cd8cd6/Le-Cr-puscule-des-Proph-ties-Richard-and-Kahlan-3-by-Terry-Goodkind.pdf
    • http://ujcsiniio.myhome.cx/6cd9cd9cd6cd5cd5/Fire-and-Sword-Sword-and-Sorcery-1-by-Dylan-Doose.pdf
    • http://ujcsiniio.myhome.cx/8cd8cd0cd3cd6cd5/The-Sword-of-Hannibal-by-Terry-McCarthy.pdf
    • http://ujcsiniio.myhome.cx/4cd3cd9cd0cd4cd3/The-Truth-Discworld-25-by-Terry-Pratchett.pdf
    • http://ujcsiniio.myhome.cx/2cd1cd4cd2cd5cd7/Flight-of-the-Fire-Thief-Fire-Thief-Trilogy-2-by-Terry-Deary.pdf
    • http://ujcsiniio.myhome.cx/1cd9cd3cd3cd1cd7/The-Sword-Vol-1-Fire-by-Jonathan-Luna.pdf
    • http://ujcsiniio.myhome.cx/2cd3cd3cd5cd6cd2/Blood-of-the-Fold-Sword-of-Truth

Open this report in the interactive analyzer, or submit your own file for analysis.