Malicious PDF — malware analysis report

Static analysis result for SHA-256 73e89f84d892d743…

MALICIOUS

PDF

29.2 KB Created: 2020-03-15 00:53:30 +00:00 Authoring application: mPDF 5.7
MD5: 34f78696285a6bd75ef8adf96dee4114 SHA-1: 0f22311d6c5c4206cb16eb38e4431c1cb06f7319 SHA-256: 73e89f84d892d743e299f1b73276cc0ade3da8a078c532645cf7ae47a3bf821f
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or distribution mechanism. The ML_NYX_PDF_MALICIOUS heuristic further supports its malicious nature. The embedded URLs likely serve as the primary mechanism for the attack, potentially leading to further malicious content or phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9908

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://owlaokopdf.myhome.cx/281658164816281608166/Blur-How-to-Know-What-s-True-in-the-Age-of-Information-Overload-by-Bill-Kovach.pdf
    • http://owlaokopdf.myhome.cx/681648166816481658168/The-New-Generation-Breast-Cancer-Book-How-to-Navigate-Your-Diagnosis-and-Treatment-Options-and-Remain-Optimistic-in-an-Age-of-Information-Overload-by-Elisa-Port.pdf
    • http://owlaokopdf.myhome.cx/181648162816281678160/Bit-of-a-Blur-The-Autobiography-by-Alex-James.pdf
    • http://owlaokopdf.myhome.cx/1816081688166816581688168/What-Happens-When-I-Die-True-Stories-of-the-Afterlife-and-What-They-Tell-Us-About-Eternity-by-Bill-Wiese.pdf
    • http://owlaokopdf.myhome.cx/181658160816981688162/Plunder-Pirate-King-1-by-R-S-Kovach.pdf
    • http://owlaokopdf.myhome.cx/781628169816081668164/Human-Interface-and-the-Management-of-Information-Information-and-Interaction-by-Gavriel-Salvendy.pdf
    • http://owlaokopdf.myhome.cx/781628169816081678167/Human-Interface-and-the-Management-of-Information-Interacting-with-Information-by-Gavriel-Salvendy.pdf
    • http://owlaokopdf.myhome.cx/981608167816781648166/Being-with-Babies-Understanding-and-Responding-to-the-Infants-in-Your-Care-by-Beverly-Kovach.pdf
    • http://owlaokopdf.myhome.cx/881678168816181658163/Medical-Information-for-the-Million-or-the-True-Guide-to-Health-on-Eclectic-and-Reformed-Principles-Being-Plain-Advice-to-Both-Sexes-in-the-Treatment-of-Nervous-Consumptive-Scrofulous-and-Other-Complaints-To-Which-Is-Added-a-Practical-Essay-on-Sexu-by-Charles-D-Hammond.pdf
    • http://owlaokopdf.myhome.cx/781698168816181668163/Information-Security-Policies-Procedures-and-Standards-Guidelines-for-Effective-Information-Security-Management-by-Thomas-R-Peltier.pdf
    • http://owlaokopdf.myhome.cx/681688163816581678167/The-Overload-Syndrome-by-Richard-A-Swenson.pdf
    • http://owlaokopdf.myhome.cx/281608161816981618167/Fighting-To-Live-Zombie-Overload-2-by-C-M-Wright.pdf
    • http://owlaokopdf.myhome.cx/381648162816181618164/Chemical-Sensitivity-Clinical-Manifestations-of-Pollutant-Overload-Vol-3-by-William-J-Rea.pdf
    • http://owlaokopdf.myhome.cx/481698163816381648163/Overload-Flux-Central-Galactic-Concordance-1-by-Carol-Van-Natta.pdf
    • http://owlaokopdf.myhome.cx/381618163816081698163/11-Stories-For-Children-Story-Collection-With-an-Overload-of-Cuteness-by-Betty-J-Byers.pdf
    • http://owlaokopdf.myhome.cx/781618166816681628167/Intelligent-Information-Systems-2001-Proceedings-of-the-International-Symposium-Intelligent-Information-Systems-X-June-18-22-2001-Zakopane-Poland-by-M-A-Kopotek.pdf
    • http://owlaokopdf.myhome.cx/281678160816181608164/The-Highly-Sensitive-How-to-Stop-Emotional-Overload-Relieve-Anxiety-and-Eliminate-Negative-Energy-by-Judy-Dyer.pdf
    • http://owlaokopdf.myhome.cx/681608165816981618169/Boule-et-Bill-Compilation-SBB---tome-1---Bill-et-Boule-de-neige-BOULE-amp-BILL-by-Dargaud.pdf
    • http://owlaokopdf.myhome.cx/881618164816381698163/Electronics-Electrical-Engineering-and-Information-Science-Proceedings-of-the-2015-International-Conference-on-Electronics-Electrical-Engineering-and-Information-Science-Eeeis2015-by-Jian-Wang.pdf
    • http://owlaokopdf.myhome.cx/98169816081638168/Bill-the-Vampire-The-Tome-of-Bill-1-by-Rick-Gualtieri.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.