Malicious PDF — malware analysis report

Static analysis result for SHA-256 62522a6807c0fe66…

MALICIOUS

PDF

15.9 KB Created: 2019-04-30 05:29:00 +01:00 Authoring application: mPDF 5.7
MD5: fcd579d2841296713556858ed7717621 SHA-1: 0306fb7ff5b5480197512cbb5ff49933f2383be4 SHA-256: 62522a6807c0fe66b0f13428f24f88638954b3663352a2533f826009575b1f10
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm, which is a common tactic for distributing malicious content. While the document body is heavily corrupted, the presence of numerous external links and a critical heuristic firing for PDF_SEO_LINK_FARM strongly suggests an attempt to trick users into downloading further malware. No scripts were extracted, but the overall structure points to a malicious downloader disguised as a document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9800

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/2a07a02a04a01a09/Lespada-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/3a09a06a06a09a05/The-Questing-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a07a05a01a03a01/The-Falls-of-Erith-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/3a09a06a09a08a05/Lord-of-Light-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/2a07a02a02a02a08/A-Collection-of-Beginnings-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a07a05a02a00a06/Swords-and-Shields-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/2a00a04a05a01a02/The-Forbidden-Highlands-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/3a09a09a03a06a02/Silversword-de-Lohr-Dynasty-8-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/1a01a02a05a00a03a00/The-Red-Lion-Highland-Warriors-of-Munro-1-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a00a00a02a09a03/The-Savage-Curtain-Dragonblade-Trilogy-3-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a07a05a00a09a09/Unending-Love-de-Lohr-Dynasty-6-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/2a00a04a05a00a09/Mists-and-Moonrise-The-Reluctant-Brides-Collection-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a07a05a02a01a00/Queen-of-Lost-Stars-Dragonblade-House-of-St-Hever-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a07a05a02a01a02/Medieval-Fallen-Heroes-Part-of-the-Medieval-Masters-Collections-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a02a03a00a08a03/The-Thunder-Knight-Book-Three-in-the-Lords-of-Thunder-The-de-Shera-Brotherhood-Trilogy-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/2a00a04a06a03a08/DarkWolfe-Sons-of-de-Wolfe-de-Wolfe-Pack-9-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/2a00a04a06a03a05/Nighthawk-Sons-of-de-Wolfe-de-Wolfe-Pack-7-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/1a09a01a01a04/Warrior-Poet-A-Biography-of-Audre-Lorde-by-Alexis-De-Veaux.pdf
    • http://muicuiu.dumb1.com/3a09a06a09a09a00/Dragonblade-Dragonblade-Trilogy-1-by-Kathryn-Le-Veque.pdf
    • http://muicuiu.dumb1.com/4a05a01a07a09a07/Qualities-of-a-Spiritual-Warrior-Way-of-the-Warrior-Series-by-Graham-Cooke.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.