Malicious PDF — malware analysis report

Static analysis result for SHA-256 76d031f8b6b15389…

MALICIOUS

PDF

17.3 KB Created: 2019-04-30 04:13:40 +01:00 Authoring application: mPDF 5.7
MD5: 50a5053e14d63ab12ebe667c767c24f7 SHA-1: 5c5a23e6318d1b30f1879fa800c7d5b2a17b824d SHA-256: 76d031f8b6b1538980015c5c6b31b9a9494853a721effecbd6c6fe8ba77cd410
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a PDF link farm. While the document body is heavily obfuscated, the heuristic 'PDF_SEO_LINK_FARM' indicates the primary purpose is to direct users to numerous other PDF files hosted at the domain 'xiixmcuin.linkpc.net'. This is a common tactic for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/2207200209208206/Mother-Hicks-by-Suzan-Zeder.pdf
    • http://xiixmcuin.linkpc.net/4206206204207202/The-Widow-of-the-South-by-Robert-Hicks.pdf
    • http://xiixmcuin.linkpc.net/4201208200204/The-Widow-of-the-South-by-Robert-Hicks.pdf
    • http://xiixmcuin.linkpc.net/4202205202203208/Overkill-Orphan-s-legacy-1-by-Robert-Buettner.pdf
    • http://xiixmcuin.linkpc.net/4202205200205208/Orphan-s-Destiny-Jason-Wander-2-by-Robert-Buettner.pdf
    • http://xiixmcuin.linkpc.net/4202205202205200/Orphan-s-Triumph-Jason-Wander-5-by-Robert-Buettner.pdf
    • http://xiixmcuin.linkpc.net/1200205203203203205/Judith-and-Holofernes-Hicks-by-Edward-Lee-Hicks.pdf
    • http://xiixmcuin.linkpc.net/1205204201203209/The-Orphan-Conspiracies-29-Conspiracy-Theories-from-The-Orphan-Trilogy-by-James-Morcan.pdf
    • http://xiixmcuin.linkpc.net/4206201202205206/The-Orphan-Factory-The-Orphan-Trilogy-2-by-James-Morcan.pdf
    • http://xiixmcuin.linkpc.net/3202205207206209/My-Mother-the-Cheerleader-by-Robert-Sharenow.pdf
    • http://xiixmcuin.linkpc.net/2200209201208208/Knees-Up-Mother-Earth-by-Robert-Rankin.pdf
    • http://xiixmcuin.linkpc.net/1207209207206207/The-French-Orphan-The-French-Orphan-1-by-Michael-Stolle.pdf
    • http://xiixmcuin.linkpc.net/3207209206202204/Don-t-Call-Me-Mother-Breaking-the-Chain-of-Mother-Daughter-Abandonment-by-Linda-Joy-Myers.pdf
    • http://xiixmcuin.linkpc.net/5208201208208/The-Complete-Mother-Daughter-Book-Club-Collection-The-Mother-Daughter-Book-Club-Much-Ado-About-Anne-Dear-Pen-Pal-Pies-amp-Prejudice-Home-for-the-Holidays-Wish-You-Were-Eyre-The-Mother-Daughter-Book-Club-1-6-by-Heather-Vogel-Frederick.pdf
    • http://xiixmcuin.linkpc.net/1204201208200206/Ask-and-It-Is-Given-by-Esther-Hicks.pdf
    • http://xiixmcuin.linkpc.net/4200205208209202/Ask-and-It-is-Given-by-Esther-Hicks.pdf
    • http://xiixmcuin.linkpc.net/1200207206200209208/A-Boy-Named-Josh-by-Ron-Hicks.pdf
    • http://xiixmcuin.linkpc.net/1205205207206204/Mason-Ark-and-the-Eagle-Empire-by-Z-J-Hicks.pdf
    • http://xiixmcuin.linkpc.net/2207200202202/The-Baby-Game-by-Randall-Hicks.pdf
    • http://xiixmcuin.linkpc.net/1201205208200201204/Sara-und-die-Eule-by-Esther-Hicks.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.