Malicious PDF — malware analysis report

Static analysis result for SHA-256 732ffd2fcd83aa42…

MALICIOUS

PDF

16.9 KB Created: 2019-04-30 02:39:42 +01:00 Authoring application: mPDF 5.7
MD5: 2792b0a0b0bd5c71625e880416c13cf5 SHA-1: 9dfb6a36db7043eefee75acc7a7a601cf0ce6aca SHA-256: 732ffd2fcd83aa4219496edbb19c60134fb988f5106621fd684f06c13f5adcbc
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. While the document body is heavily obfuscated, the presence of numerous links to external PDFs suggests a tactic to drive traffic or potentially distribute further malicious content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a03a05a06a06a08/The-Prince-of-the-Wind-Karazan-Quartet-3-by-V-M-Jones.pdf
    • http://muicuiu.dumb1.com/4a05a00a03a08a03/The-Spellcoats-The-Dalemark-Quartet-3-by-Diana-Wynne-Jones.pdf
    • http://muicuiu.dumb1.com/1a07a02a05a01a09/Cart-and-Cwidder-The-Dalemark-Quartet-1-by-Diana-Wynne-Jones.pdf
    • http://muicuiu.dumb1.com/1a00a06a04a01a08/Cart-and-Cwidder-The-Dalemark-Quartet-1-by-Diana-Wynne-Jones.pdf
    • http://muicuiu.dumb1.com/2a02a04a00a08a09/Standing-Against-the-Wind-by-Traci-L-Jones.pdf
    • http://muicuiu.dumb1.com/3a07a08a08a06a04/Whispers-in-the-Wind-by-Frankie-J-Jones.pdf
    • http://muicuiu.dumb1.com/3a07a08a03a03a03/Once-Upon-a-Prince-Ever-After-2-by-Jambrea-Jo-Jones.pdf
    • http://muicuiu.dumb1.com/9a07a07a09a03a09/Fair-Wind-to-Widdershins-The-Six-Crowns-2-by-Allan-Frewin-Jones.pdf
    • http://muicuiu.dumb1.com/4a08a03a03a06a01/Prince-Vampire-by-Amarinda-Jones.pdf
    • http://muicuiu.dumb1.com/9a09a05a01a09a04/Who-Was-Mark-Twain-by-April-Jones-Prince.pdf
    • http://muicuiu.dumb1.com/3a07a06a07a06a06/Forbidden-A-Prince-s-Most-Coveted-Possession-by-E-L-R-Jones.pdf
    • http://muicuiu.dumb1.com/1a01a09a05a03/Prince-of-Magic-Children-of-the-Sun-1-by-Linda-Winstead-Jones.pdf
    • http://muicuiu.dumb1.com/2a08a07a09a04a05/Prince-of-Fire-Children-of-the-Sun-2-by-Linda-Winstead-Jones.pdf
    • http://muicuiu.dumb1.com/4a03a06a00a01/Bride-Quartet-Boxed-Set-Bride-Quartet-1-4-by-Nora-Roberts.pdf
    • http://muicuiu.dumb1.com/4a04a06a01a03/The-Wind-on-Fire-Trilogy-The-Wind-Singer-Slaves-of-the-Mastery-Firesong-by-William-Nicholson.pdf
    • http://muicuiu.dumb1.com/1a02a05a06a06a08/The-Wind-Singer-Wind-on-Fire-trilogy-1-by-William-Nicholson.pdf
    • http://muicuiu.dumb1.com/1a02a06a07a01a05/The-Dryad-Quartet-The-Dryad-Quartet-1-4-by-Katie-Jennings.pdf
    • http://muicuiu.dumb1.com/3a03a01a07a03/The-Alexandria-Quartet-The-Alexandria-Quartet-1-4-by-Lawrence-Durrell.pdf
    • http://muicuiu.dumb1.com/4a04a01a09a00/The-Wind-Singer-Wind-on-Fire-1-by-William-Nicholson.pdf
    • http://muicuiu.dumb1.com/1a01a04a07a09a04a01/The-Prince-of-Tennis-Vol-41-The-Final-Battle-The-Prince-VS-the-Child-of-God-by-Takeshi-Konomi.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.