Malicious PDF — malware analysis report

Static analysis result for SHA-256 68b3e688636073df…

MALICIOUS

PDF

20.7 KB Created: 2019-05-07 03:58:40 +01:00 Authoring application: mPDF 5.7
MD5: 1ba2a560486c4d53719a4ca8cb19c95c SHA-1: e1e91d7ff3ece73dd81196e56bcec7d732c2aa7c SHA-256: 68b3e688636073df160a6dccd2dfbd657411ae7a425addb74a8c5b47b4987b3d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which are disguised as book titles, and a visual download button. This suggests a social engineering attempt to trick users into downloading potentially malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9923

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/3a00a08a04a08a04/The-Devils-Cradle-by-Darcy-Daniel.pdf
    • http://muicuiu.dumb1.com/1a01a03a05a00a09/Playing-the-Part-by-Darcy-Daniel.pdf
    • http://muicuiu.dumb1.com/4a01a08a04a05a00/-devils-and-realist-1-Makai-Ouji-Devils-and-Realist-1-Devils-and-Realist-1-by-Madoka-Takadono.pdf
    • http://muicuiu.dumb1.com/9a07a05a00a08a05/Einfach-intelligent-produzieren-Cradle-to-Cradle-die-Natur-zeigt-wie-wir-die-Dinge-besser-machen-k-nnen-by-Michael-Braungart.pdf
    • http://muicuiu.dumb1.com/5a00a06a05a09a06/Men-to-Devils-Devils-to-Men-Japanese-War-Crimes-and-Chinese-Justice-by-Barak-Kushner.pdf
    • http://muicuiu.dumb1.com/8a06a01a06a05a02/Devils-with-Wings-The-Green-Devils-Assault-on-Fort-Eben-Emael-by-Harvey-Black.pdf
    • http://muicuiu.dumb1.com/1a00a06a06a02a07a06/The-Jewish-Life-Cycle-Lore-and-Iconography-Jewish-Customs-from-the-Cradle-to-the-Grave-by-Daniel-Sperber.pdf
    • http://muicuiu.dumb1.com/1a05a04a06a04a08/Empty-Cradle-Shiloh-in-the-Circle-Empty-Cradle-2-by-Emmy-Jackson.pdf
    • http://muicuiu.dumb1.com/2a00a06a08a00/Cradle-of-Secrets-Cradle-of-Secrets-1-by-Lisa-Mondello.pdf
    • http://muicuiu.dumb1.com/2a05a05a01a03a03/Tigers-and-Devils-Tigers-and-Devils-1-by-Sean-Kennedy.pdf
    • http://muicuiu.dumb1.com/1a02a06a00a00a01/Devils-amp-Thieves-Devils-amp-Thieves-1-by-Jennifer-Rush.pdf
    • http://muicuiu.dumb1.com/5a09a00a08a06a00/Handbook-for-Hot-Witches-Dame-Darcy-s-Illustrated-Guide-to-Magic-Love-and-Creativity-by-Dame-Darcy.pdf
    • http://muicuiu.dumb1.com/3a04a04a05a05a00/Mister-Darcy-s-Dogs-A-Mister-Darcy-Series-Comedic-Mystery-1-by-Barbara-Silkstone.pdf
    • http://muicuiu.dumb1.com/1a04a06a09a02a09/Darcy-amp-Elizabeth-Nights-and-Days-at-Pemberley-Darcy-amp-Elizabeth-2-by-Linda-Berdoll.pdf
    • http://muicuiu.dumb1.com/1a06a04a06a01a02/Jade-Darcy-and-the-Affair-of-Honor-The-Rehumanization-of-Jade-Darcy-1-by-Stephen-Goldin.pdf
    • http://muicuiu.dumb1.com/2a05a01a01a08/Cat-s-Cradle-by-Kurt-Vonnegut.pdf
    • http://muicuiu.dumb1.com/2a09a06a06a00a00/Cradle-and-All-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/1a00a04a03a01a08/The-Bone-Cradle-by-C-E-Trueman.pdf
    • http://muicuiu.dumb1.com/2a06a06a02a04a02/Cradle-and-All-by-James-Patterson.pdf
    • http://muicuiu.dumb1.com/2a02a07a01a00a09/Cradle-by-Arthur-C-Clarke.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.