Malicious PDF — malware analysis report

Static analysis result for SHA-256 67e3286ab553d912…

MALICIOUS

PDF

12.7 KB Created: 2019-04-30 06:45:43 +01:00 Authoring application: mPDF 5.7
MD5: c7c1dece72b3a5daa7dd2214e1af582f SHA-1: 86389fd6d968142a0b38c4adae20b16c8344b1ba SHA-256: 67e3286ab553d9125097bb9969fcb5801d0e8be68e38bbc892395cf7c85866cf
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm. The heuristic 'PDF_SEO_LINK_FARM' indicates this is a technique to manipulate search engine results or distribute content. While the URLs themselves are currently marked as benign, the sheer volume and the nature of the heuristic suggest a malicious intent to redirect users to potentially harmful or unwanted content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.8780

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/6207202209204208/Rebel-Rebel-Wheels-1-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/6207202209207207/Trouble-Rebel-Wheels-3-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/2209207202202207/Renegade-Rebel-Part-III-Bad-Blooded-Rebel-1-by-Mellie-George.pdf
    • http://xiixmcuin.linkpc.net/2209207202203200/Rogue-Rebel-Part-II-Bad-Blooded-Rebel-1-by-Mellie-George.pdf
    • http://xiixmcuin.linkpc.net/3209209202206202/Rebel-Part-I-Bad-Blooded-Rebel-1-by-Mellie-George.pdf
    • http://xiixmcuin.linkpc.net/4201205209206206/Rebel-Song-Rebel-Song-1-by-Amanda-J-Clay.pdf
    • http://xiixmcuin.linkpc.net/1200208206200206/Rebel-Wing-Rebel-Wing-1-by-Tracy-Banghart.pdf
    • http://xiixmcuin.linkpc.net/2207208207/Rebel-of-the-Sands-Rebel-of-the-Sands-1-by-Alwyn-Hamilton.pdf
    • http://xiixmcuin.linkpc.net/5201201206/Rebel-of-the-Sands-Rebel-of-the-Sands-1-by-Alwyn-Hamilton.pdf
    • http://xiixmcuin.linkpc.net/4205200205204209/All-the-Glory-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/3205207206205203/Mismatched-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/1203202209208208/After-the-Fall-War-of-the-Fae-5-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/4201202206202204/Supernatural-Six-Box-Set-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/6207203200203206/After-the-Fall-War-of-the-Fae-5-by-Elle-Casey.pdf
    • http://xiixmcuin.linkpc.net/4200204209201201/A-Heart-for-Rebel-by-Mia-Natal.pdf
    • http://xiixmcuin.linkpc.net/1202202205204206/Rebel-Heart-by-L-K-Farlow.pdf
    • http://xiixmcuin.linkpc.net/7200200205202203/The-Rebel-by-Adrienne-Giordano.pdf
    • http://xiixmcuin.linkpc.net/3205209208207208/The-Rebel-by-Rhonda-Nelson.pdf
    • http://xiixmcuin.linkpc.net/4209200205205205/There-s-Something-About-a-Rebel-by-Anne-Oliver.pdf
    • http://xiixmcuin.linkpc.net/1202206205204209/Exodus-Apocalypsis-3-by-Elle-Casey.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.