Malicious PDF — malware analysis report

Static analysis result for SHA-256 72f25ae538091fe4…

MALICIOUS

PDF

15.2 KB Created: 2020-03-20 13:49:04 +00:00 Authoring application: mPDF 5.7
MD5: d068bfc2335c5360dd58e23b841106a0 SHA-1: 3a9443278889f4f67554a887f8a25b120d11c567 SHA-256: 72f25ae538091fe4e1e6ce6b3eb43ec25b32be1848d8c533f943c626f7002e49
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. These links all point to domains that appear to be part of a link farm, suggesting a phishing or malicious redirection scheme. The ML_NYX_PDF_MALICIOUS heuristic also flagged this PDF with high confidence. No scripts were extracted, but the embedded links are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/252455247524152405240/Handle-with-Care-by-Josephine-Myles.pdf
    • http://lwoscmobook.myhome.cx/352405246524952435244/Handle-with-Care-by-Josephine-Myles.pdf
    • http://lwoscmobook.myhome.cx/452415243524852495246/Stuff-The-Bristol-Collection-2-by-Josephine-Myles.pdf
    • http://lwoscmobook.myhome.cx/15248524852495248/Tailor-Made-by-Yolanda-Wallace.pdf
    • http://lwoscmobook.myhome.cx/252485249524652405242/A-Tailor-Made-Romance-by-Sadie-Finney.pdf
    • http://lwoscmobook.myhome.cx/252455246524152455248/Screwing-the-System-Screwing-the-System-1-by-Josephine-Myles.pdf
    • http://lwoscmobook.myhome.cx/552475248524452425244/The-Best-Tailor-in-Pinbau-by-Eymard-Toledo.pdf
    • http://lwoscmobook.myhome.cx/95243524152465240/The-Gentlemen-s-Tailor-by-Mariana-Leky.pdf
    • http://lwoscmobook.myhome.cx/652465244524452405241/The-Tailor-of-Giripul-by-Bulbul-Sharma.pdf
    • http://lwoscmobook.myhome.cx/15247524152455242/The-Journeyman-Tailor-by-Gerald-Seymour.pdf
    • http://lwoscmobook.myhome.cx/652405240524352425243/The-Tailor-of-Ulm-A-History-of-Communism-by-Lucio-Magri.pdf
    • http://lwoscmobook.myhome.cx/252415242524152465249/The-Tailor-Grisha-Verse-1-5-by-Leigh-Bardugo.pdf
    • http://lwoscmobook.myhome.cx/852495244524552405240/Wanderings-of-a-journeyman-tailor-through-Europe-and-the-East-during-the-by-P-D-Holthaus.pdf
    • http://lwoscmobook.myhome.cx/1524152465249524952465241/The-Best-of-Myles-by-Flann-O-39-Brien.pdf
    • http://lwoscmobook.myhome.cx/152495241524252475249/Transplanted-by-Sarah-Myles.pdf
    • http://lwoscmobook.myhome.cx/252475242524852435241/The-Real-You-by-Elizabeth-Myles.pdf
    • http://lwoscmobook.myhome.cx/352425243524452465246/Dark-Light-by-Jill-Myles.pdf
    • http://lwoscmobook.myhome.cx/1524152455242524052465245/Unlock-Your-Potential-Becoming-Your-Best-You-by-Myles-Munroe.pdf
    • http://lwoscmobook.myhome.cx/1524152465242524352425240/Create-Your-Own-Universe-by-Myles-McLeod.pdf
    • http://lwoscmobook.myhome.cx/452405244524552405249/A-Broken-Cradle-by-Myles-Swain.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.