Malicious PDF — malware analysis report

Static analysis result for SHA-256 587da2e7976eb76b…

MALICIOUS

PDF

22.1 KB Created: 2019-04-22 19:23:27 +01:00 Authoring application: mPDF 5.7
MD5: 6cc498fde26e68b4a13428aca87fcd00 SHA-1: eb94504dde137db2c92517b81f54595186aad36a SHA-256: 587da2e7976eb76b216495b670d3715bd6577175e6576e6ed921699f12f598f8
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious and contains a large number of embedded links. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass of external PDF links, with the first URL being http://zoioxiop.linkpc.net/6c40c48c43c46c46/Gouverneur-Morris-An-Independent-Life-by-William-Howard-Adams.pdf. While many of these links were classified as benign, the sheer volume and the ML detection suggest a malicious intent, possibly for SEO manipulation or to host further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zoioxiop.linkpc.net/6c40c48c43c46c46/Gouverneur-Morris-An-Independent-Life-by-William-Howard-Adams.pdf
    • http://zoioxiop.linkpc.net/6c40c48c44c42c43/The-Diaries-of-Gouverneur-Morris-European-Travels-1794-1798-by-Gouverneur-Morris.pdf
    • http://zoioxiop.linkpc.net/7c42c45c44c47c47/Diary-and-Letters-of-Gouverneur-Morris-Volume-1-by-Anne-Cary-Morris.pdf
    • http://zoioxiop.linkpc.net/6c40c48c43c47c47/The-Penalty-by-Gouverneur-Morris.pdf
    • http://zoioxiop.linkpc.net/6c40c48c43c48c44/The-Seven-Darlings-by-Gouverneur-Morris.pdf
    • http://zoioxiop.linkpc.net/6c40c48c43c49c41/Gouverneur-Morris-Creating-a-Nation-by-Samuel-Willard-Crompton.pdf
    • http://zoioxiop.linkpc.net/6c40c48c43c48c47/Gouverneur-Morris-Author-Statesman-and-Man-of-the-World-by-James-J-Kirschke.pdf
    • http://zoioxiop.linkpc.net/3c46c49c48c45c41/Gentleman-Revolutionary-Gouverneur-Morris-the-Rake-Who-Wrote-the-Constitution-by-Richard-Brookhiser.pdf
    • http://zoioxiop.linkpc.net/1c40c42c44c49c49c45/The-First-William-Morris-Omnibus-The-House-of-the-Wolflings-The-Well-at-the-World-s-End-Wood-Beyond-the-World-by-William-Morris.pdf
    • http://zoioxiop.linkpc.net/6c46c44c42c46c43/Homage-to-Gaia-The-Life-of-an-Independent-Scientist-by-James-E-Lovelock.pdf
    • http://zoioxiop.linkpc.net/7c49c42c44c44c49/A-Life-Looking-Forward-Memoirs-of-an-Independent-Marxist-by-Samir-Amin.pdf
    • http://zoioxiop.linkpc.net/1c40c41c47c47c45c44/Douglas-Adams-5-Books-set-The-Hitchhiker-s-Guide-to-the-Galaxy-The-Restaurant-at-the-End-of-the-Universe-Life-The-Universe-and-Everything-So-Long-and-Thanks-for-all-the-Fish-and-Mostly-Harmless-by-Douglas-Adams.pdf
    • http://zoioxiop.linkpc.net/4c43c43c43c48c48/The-Glittering-Plain-by-William-Morris.pdf
    • http://zoioxiop.linkpc.net/9c48c47c45c41c44/The-Roots-of-the-Mountains-by-William-Morris.pdf
    • http://zoioxiop.linkpc.net/1c45c46c44c41c42/The-Wood-Beyond-the-World-by-William-Morris.pdf
    • http://zoioxiop.linkpc.net/4c45c47c41c49/John-Quincy-Adams-A-Public-Life-a-Private-Life-by-Paul-C-Nagel.pdf
    • http://zoioxiop.linkpc.net/5c49c46c42c44c44/PRESIDENT-TRUMP-and-the-SECOND-AMERICAN-REVOLUTION-Make-Independent-Life-Knowledgeable-Book-2-RAW-MILK-Uncensored-Edition-by-Joe-Pelech.pdf
    • http://zoioxiop.linkpc.net/5c49c46c42c44c49/Donald-Trump-and-Voices-of-the-2nd-American-Revolution-Make-Independent-Life-Knowledgeable-Censored-Edition-Book-1-by-Joe-Nickolas-Pelech.pdf
    • http://zoioxiop.linkpc.net/1c41c49c40c40c42c43/William-Morris-1834-1896-by-Richard-Tames.pdf
    • http://zoioxiop.linkpc.net/3c40c47c49c45/The-Fantastic-Flying-Books-of-Mr-Morris-Lessmore-by-William-Joyce.pdf
    • http://zoioxiop.linkpc.net/1c40c42c44c49c49c45/The-First-William-Morris-Omnibus-The-House-of-the

Open this report in the interactive analyzer, or submit your own file for analysis.