Malicious PDF — malware analysis report

Static analysis result for SHA-256 791e3689167ec67a…

MALICIOUS

PDF

19.7 KB Created: 2020-03-15 00:49:19 +00:00 Authoring application: mPDF 5.7
MD5: ba1c8c4d425dc60b18079c0934be5504 SHA-1: 7ccec5e3c8a944d0f5e9d4c5f2d21ba2fbff48ff SHA-256: 791e3689167ec67a3be60ed9f4c3f173e5682e149497adb1370a465ae871c6ad
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF was flagged by a critical heuristic for containing a large number of external links, forming a link farm. The embedded URLs, such as http://eascasas.myhome.cx/1aa1aa0aa5aa7aa0aa8/The-Wonderful-Wizard-of-Oz-Annotated-and-Illustrated-JestMaster-Legacy-Edition-by-L-Frank-Baum.pdf, are likely used to lure victims into downloading further malicious content or visiting phishing sites. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://eascasas.myhome.cx/1aa1aa0aa5aa7aa0aa8/The-Wonderful-Wizard-of-Oz-Annotated-and-Illustrated-JestMaster-Legacy-Edition-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/5aa7aa4aa1aa9aa2/The-Wonderful-Wizard-of-Oz-New-Illustrated-Edition-with-Original-Drawings-by-W-W-Denslow-amp-with-4-Book-Trailers-by-Wirton-Arvel-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/7aa7aa1aa0aa3aa9/Wizard-of-Oz-Illustrated-Annotated-Complete-Collection-Deluxe-Illustrated-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/7aa7aa6aa5aa9aa8/The-Wonderful-Wizard-of-Oz-illustrated-by-W-W-Denslow-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/8aa4aa4aa9aa8aa2/The-Wonderful-Wizard-of-OZ-The-Original-Book-Annotated-The-Ultimate-Fantasy-Fiction-Classic-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/9aa7aa9aa7aa3aa1/Der-Wunderbare-Zauberer-Von-Oz-The-Wonderful-Wizard-of-Oz-German-Edition-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/5aa3aa1aa3aa0aa2/The-Wonderful-Wizard-of-Oz-unabridged---illustrated---first-published-in-1900-1st-Page-Classics-for-Kids-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/8aa9aa5aa0aa6/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/8aa3aa3aa6aa0aa2/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/1aa0aa8aa3aa7aa6aa0/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/9aa5aa4aa1aa5aa0/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/1aa0aa4aa4aa4aa7/The-Wonderful-Wizard-of-Oz-Oz-1-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/9aa9aa4aa4aa8aa7/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/6aa3aa3aa4aa6aa3/The-Wonderful-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/9aa0aa0aa9aa7aa4/The-Wizard-of-the-Emerald-City-Adapted-from-L-Frank-Baum-s-the-Wizard-of-Oz-And-Urfin-Jus-and-His-Wooden-Soldiers-by-Alexander-Volkov.pdf
    • http://eascasas.myhome.cx/7aa3aa6aa4aa6aa4/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/5aa5aa0aa0aa4aa3/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/1aa0aa7aa2aa2aa9aa4/The-Wizard-of-Oz-Il-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/6aa1aa8aa9aa5aa5/The-Wizard-of-Oz-by-L-Frank-Baum.pdf
    • http://eascasas.myhome.cx/1aa0aa1aa9aa5aa4aa0/The-Wizard-of-Oz-by-L-Frank-Baum.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.