Malicious PDF — malware analysis report

Static analysis result for SHA-256 52fcbb268d6c5d3e…

MALICIOUS

PDF

20.4 KB Created: 2019-04-30 03:17:19 +01:00 Authoring application: mPDF 5.7
MD5: d9985d74ea3e0d6449ea5022f70082c1 SHA-1: c8df760836575dec9d897078fc6b86ca77a0e5cf SHA-256: 52fcbb268d6c5d3e1c611fd63232a35cd4e8d79f2d98e639833d86ba3fa9ccb0
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, characteristic of a link farm. This suggests a social engineering attempt to direct users to potentially malicious content or to manipulate search engine rankings. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.l
    • http://xiixmcuin.linkpc.net/1200205201205201206/I-Can-Learn-from-You-Boys-as-Relational-Learners-by-Michael-Reichert.pdf
    • http://xiixmcuin.linkpc.net/4200204207202203/Relational-Tri-Umph-Solving-Relational-Stress-and-Building-Relational-Success-by-Gerry-M-Goertzen.pdf
    • http://xiixmcuin.linkpc.net/6208204200200200/The-Relational-Syllogism-A-Systematic-Approach-To-Relational-Logic-by-G-B-Keene.pdf
    • http://xiixmcuin.linkpc.net/1200207202204203202/The-Relational-Manager-Transform-Your-Workplace-and-Your-Life-by-Michael-Schluter.pdf
    • http://xiixmcuin.linkpc.net/1200205201201206204/To-Protect-I-Robot-Reichert-1-by-Mickey-Zucker-Reichert.pdf
    • http://xiixmcuin.linkpc.net/5201201209203202/Macmillan-English-Dictionary-for-Advanced-Learners-by-Michael-Rundell.pdf
    • http://xiixmcuin.linkpc.net/9202208206207202/Learn-Enough-Git-to-Be-Dangerous-by-Michael-Hartl.pdf
    • http://xiixmcuin.linkpc.net/1208205207207209/D-Boys-by-Michael-Stephen-Fuchs.pdf
    • http://xiixmcuin.linkpc.net/9200203204200208/The-State-Boys-Rebellion-by-Michael-D-39-Antonio.pdf
    • http://xiixmcuin.linkpc.net/9207203200209207/Counter-Assault-D-Boys-2-by-Michael-Stephen-Fuchs.pdf
    • http://xiixmcuin.linkpc.net/5206200208207205/scikit-learn-Machine-Learning-Simplified-Implement-scikit-learn-into-every-step-of-the-data-science-pipeline-by-Ra-l-Garreta.pdf
    • http://xiixmcuin.linkpc.net/2201207209201209/The-Purpose-of-Boys-Helping-Our-Sons-Find-Meaning-Significance-and-Direction-in-Their-Lives-by-Michael-Gurian.pdf
    • http://xiixmcuin.linkpc.net/6208204200200201/Relational-Syllogisms-and-the-History-of-Arabic-Logic-900-1900-by-K-El-Rouayheb.pdf
    • http://xiixmcuin.linkpc.net/8202202204200202/Ruby-on-Rails-3-Tutorial-Learn-Rails-by-Example-Addison-Wesley-Professional-Ruby-Series-by-Michael-Hartl.pdf
    • http://xiixmcuin.linkpc.net/1201209201209208207/Query-Optimization-in-Relational-Database-Management-Systems-Theory-and-Practice-by-Anisoara-Nica.pdf
    • http://xiixmcuin.linkpc.net/1201209200201202206/Relandxml-A-System-to-Manage-XML-Based-Course-Material-with-Object-Relational-Databases-by-Astrid-Schnadelbach.pdf
    • http://xiixmcuin.linkpc.net/5207200205/The-Simplicity-of-Cider-by-Amy-E-Reichert.pdf
    • http://xiixmcuin.linkpc.net/1200205201205202201/Wenn-ich-mal-gro-bin-by-Martin-Reichert.pdf
    • http://xiixmcuin.linkpc.net/1200205201205201207/Jimmy-Reardon-by-William-Reichert.pdf
    • http://xiixmcuin.linkpc.net/1200205201202203205/Spirit-Fox-by-Mickey-Zucker-Reichert.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.