Malicious PDF — malware analysis report

Static analysis result for SHA-256 74f3b4a83aaeb824…

MALICIOUS

PDF

18.1 KB Created: 2020-03-13 06:45:52 +00:00 Authoring application: mPDF 5.7
MD5: c76e580ab4135b3fe4c6e1ee308c72f0 SHA-1: ee8e2c707eea1f028716ef487de9e1f3e71dbc1d SHA-256: 74f3b4a83aaeb8248fcf9fe0920014664822c6f10101a0f9fe5b48819ba33bdb
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which suggests a link farm or redirection scheme. The ML_NYX_PDF_MALICIOUS heuristic further supports the malicious nature of the file. The embedded URLs likely serve as a lure to download further malicious content or redirect to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9931

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/15241524352495245/Tremaine-s-True-Love-True-Gentlemen-1-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/352445244524452425249/Will-s-True-Wish-True-Gentlemen-3-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/152425245524152435246/The-Duke-s-Disaster-True-Gentlemen-0-5-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/352445249524152465243/Jack-Jaded-Gentlemen-4-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/252445249524952445240/Matthew-Jaded-Gentlemen-2-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/252425244524652415247/True-Luck-True-Love-1-by-Anyta-Sunday.pdf
    • http://lwoscmobook.myhome.cx/352405240524052435248/Must-Love-Scotland-Highland-Holiday-3-4-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/1524052425247524652485240/Elias-in-Love-Trouble-Wears-Tartan-2-by-Grace-Burrowes.pdf
    • http://lwoscmobook.myhome.cx/752495249524252485241/True-Gentlemen-The-Broken-Pledge-of-America-s-Fraternities-by-John-Hechinger.pdf
    • http://lwoscmobook.myhome.cx/152475244524352445245/True-The-Story-of-Us-1-by-Gwendolyn-Grace.pdf
    • http://lwoscmobook.myhome.cx/552405241524152445247/Rainbows-Rowan-and-True-True-Romance-Ally-s-World-11-by-Karen-McCombie.pdf
    • http://lwoscmobook.myhome.cx/252485240524652455243/Rainbows-Rowan-and-True-True-Romance-Ally-s-World-11-by-Karen-McCombie.pdf
    • http://lwoscmobook.myhome.cx/252455245524052495247/True-Beginnings-True-2-by-Willow-Madison.pdf
    • http://lwoscmobook.myhome.cx/152475240524952445249/True-Choices-True-3-by-Willow-Madison.pdf
    • http://lwoscmobook.myhome.cx/252415242524052465249/True-Control-True-4-2-by-Willow-Madison.pdf
    • http://lwoscmobook.myhome.cx/252475240524652485244/True-Devotion-True-2-by-Liora-Blake.pdf
    • http://lwoscmobook.myhome.cx/352435244524952485243/Saving-Grace-The-True-Story-of-a-Mother-to-be-a-Deranged-Attacker-and-an-Unborn-Child-by-Sarah-Brady.pdf
    • http://lwoscmobook.myhome.cx/852415241524452435246/Love-by-Deception-A-harrowing-true-story-of-love-and-betrayal-by-K-C-Barnard.pdf
    • http://lwoscmobook.myhome.cx/152475242524052405240/I-Love-You-Phillip-Morris-A-True-Story-of-Life-Love-amp-Prison-Breaks-by-Steve-McVicker.pdf
    • http://lwoscmobook.myhome.cx/452495248524452435244/True-Love-Caitlin-Love-Trilogy-3-by-Francine-Pascal.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.