Malicious PDF — malware analysis report

Static analysis result for SHA-256 74d2a32685f42cee…

MALICIOUS

PDF

16.2 KB Created: 2019-05-07 04:13:14 +01:00 Authoring application: mPDF 5.7
MD5: 9062b58176cf5d471a25ae80f2206121 SHA-1: 0b29a0a78bc3819aee27fc509ef4af07b4222c00 SHA-256: 74d2a32685f42cee90002644df67ce8e46b1e50829b94d41f1fc4764a9ae453d
100 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by an ML classifier as malicious and contains a large number of embedded external links, characteristic of a link farm. While the document body is heavily obfuscated, the presence of numerous links suggests an attempt to direct users to potentially harmful content. The heuristic 'PDF_SEO_LINK_FARM' indicates a mass external PDF link farm, and the 'SE_DOWNLOAD_BUTTON' heuristic suggests a call-to-action lure, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9811

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/6a02a06a00a03a02/The-Party-Sprite-of-Aurelie-Place-by-M-Elizabeth.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a07a05/Dinner-Party-Blackmail-Rough-group-play-between-a-teen-housewife-and-three-dominant-strangers-Cheating-Wife-Stories-Book-3-by-Anya-Aurelie.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a02a08/Weihnachten-mit-Aur-lie-by-Aur-lie-Bastian.pdf
    • http://muicuiu.dumb1.com/3a07a05a04a00a04/Hunting-Party-Familias-1-by-Elizabeth-Moon.pdf
    • http://muicuiu.dumb1.com/3a00a04a03a01a04/Cera-s-Place-by-Elizabeth-McKenna.pdf
    • http://muicuiu.dumb1.com/4a07a06a04a09a09/The-Hustle-Other-Place-1-by-Elizabeth-Roderick.pdf
    • http://muicuiu.dumb1.com/7a01a03a06a00a05/Emily-Mike-Spritely-Sprite-and-the-rainbow-The-colourful-adventures-of-Emily-Mike-and-Spritely-Sprite-Book-1-by-Peter-Goldsworthy.pdf
    • http://muicuiu.dumb1.com/4a09a01a03a07a09/Polly-the-Party-Fun-Fairy-Rainbow-Magic-19-Party-Fairies-5-by-Daisy-Meadows.pdf
    • http://muicuiu.dumb1.com/7a01a03a09a05a09/Forking-Fantastic-Put-the-Party-Back-in-Dinner-Party-by-Zora-O-39-Neill.pdf
    • http://muicuiu.dumb1.com/1a01a09a00a03a03a03/Let-s-Party-How-to-Succeed-in-Party-Plan-by-Jan-Ruhe.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a00a00/Aurelie-Nemours-by-Aurelie-Nemours.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a01a00/Aurelie-Nemours-by-Aurelie-Nemours.pdf
    • http://muicuiu.dumb1.com/6a02a05a09a09a04/Aurelie-by-Peter-Foreman.pdf
    • http://muicuiu.dumb1.com/7a01a03a05a05a00/The-Sprite-And-I-by-Rob-Shelsky.pdf
    • http://muicuiu.dumb1.com/8a01a07a08a07a00/Le-business-est-dans-le-pr-by-Aur-lie-Trouv-.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a07a04/The-Boss-Won-t-Pull-Out-1-by-Anya-Aurelie.pdf
    • http://muicuiu.dumb1.com/7a01a03a05a03a05/The-Sprite-by-David-Shaw.pdf
    • http://muicuiu.dumb1.com/7a01a03a05a03a06/The-Sea-Sprite-by-Jane-McIlvaine.pdf
    • http://muicuiu.dumb1.com/7a01a03a05a03a00/Sprite-Night-by-Deborah-Jay.pdf
    • http://muicuiu.dumb1.com/6a02a06a00a06a03/Aur-lie-Psalms-of-the-Apocalypse-Book-4-by-J-Blackshear.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.