Malicious PDF — malware analysis report

Static analysis result for SHA-256 71cc4cff7d9248bd…

MALICIOUS

PDF

13.4 KB Created: 2020-03-18 22:37:40 +00:00 Authoring application: mPDF 5.7
MD5: 814984da04b9bca0bc0541933413fc2f SHA-1: 40efa1291ffe47fea6b07222dd19dfc39b5ea96f SHA-256: 71cc4cff7d9248bdb90a346d7ce77e0bb6f5d4b970eac5dd3c781af7c5344ca8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, and exhibits a critical heuristic for a PDF link farm. The document body contains numerous embedded URLs, each pointing to a different PDF file hosted on the same domain. This suggests the file is designed to distribute or redirect to other malicious content, potentially as part of a phishing or SEO spam campaign. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9102

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7664503-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7664503-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ewasocmo.myhome.cx/1c35c32c37c31c38/Watchers-of-Time-Inspector-Ian-Rutledge-5-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/3c37c31c32c37c39/A-Fearsome-Doubt-Inspector-Ian-Rutledge-6-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/2c37c30c39c34/Legacy-of-the-Dead-Inspector-Ian-Rutledge-4-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c35c32c35c32c34/A-Long-Shadow-Inspector-Ian-Rutledge-8-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c35c32c36c39c35/Search-the-Dark-Inspector-Ian-Rutledge-3-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c35c38c30c31c31/Racing-the-Devil-Inspector-Ian-Rutledge-19-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c33c35c30c35c32/Wings-of-Fire-Inspector-Ian-Rutledge-2-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/3c31c34c31c36/Hunting-Shadows-Inspector-Ian-Rutledge-16-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c37c31c30c30/A-Test-of-Wills-Inspector-Ian-Rutledge-1-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c34c39c38c35c33/A-False-Mirror-Inspector-Ian-Rutledge-9-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/2c33c31c33c30c31/A-Matter-of-Justice-Inspector-Ian-Rutledge-11-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c30c32c36c39c38c33/Dunkle-Spuren-Ein-Inspektor-Rutledge-Roman-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/9c37c32c39c31c32/Stumme-Geister-Roman-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/3c31c34c31c35/An-Unwilling-Accomplice-Bess-Crawford-6-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/8c33c32c31c34/A-Duty-to-the-Dead-Bess-Crawford-1-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c36c33c35c38c38/The-Shattered-Tree-Bess-Crawford-8-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/3c31c34c33c34/An-Unmarked-Grave-Bess-Crawford-4-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/3c37c30c37c30c30/A-Duty-To-The-Dead-Bess-Crawford-1-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c35c38c30c30c30/An-Impartial-Witness-Bess-Crawford-2-by-Charles-Todd.pdf
    • http://ewasocmo.myhome.cx/1c30c38c39c39c30c33/The-Girl-on-the-Beach-Bess-Crawford-1-1-by-Charles-Todd.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.