Malicious PDF — malware analysis report

Static analysis result for SHA-256 794482f882c83867…

MALICIOUS

PDF

21.7 KB Created: 2019-05-02 18:40:42 +01:00 Authoring application: mPDF 5.7
MD5: 33569cb08b43104c8ab964f2d3ec5946 SHA-1: db4d7a7590c5d81e6e1c96714fcd4b5887b0eb44 SHA-256: 794482f882c83867730dfced19fd9cfafe5f28379e66bbfbc84643a7e857dff9
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, hosted on the dynamic DNS domain xiixmcuin.linkpc.net. This behavior is indicative of a link farm or a lure to a large collection of potentially malicious documents. The ML classifier strongly supports the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9920

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/3200205206204205/Cul-de-Sac-The-Mighty-Alice-by-Richard-Thompson.pdf
    • http://xiixmcuin.linkpc.net/8207207204209/Justine-by-Alice-Thompson.pdf
    • http://xiixmcuin.linkpc.net/4208206203207/Twelve-Mighty-Orphans-The-Inspiring-True-Story-of-the-Mighty-Mites-Who-Ruled-Texas-Football-by-Jim-Dent.pdf
    • http://xiixmcuin.linkpc.net/1207209206204204/The-Mighty-Quinns-Ronan-Marcus-The-Mighty-Quinns-22-and-9-by-Kate-Hoffmann.pdf
    • http://xiixmcuin.linkpc.net/9202200201200203/The-Mighty-Quinns-Logan-The-Mighty-Quinns-23-by-Kate-Hoffmann.pdf
    • http://xiixmcuin.linkpc.net/9202200201202204/The-Mighty-Quinns-Teague-The-Mighty-Quinns-14-by-Kate-Hoffmann.pdf
    • http://xiixmcuin.linkpc.net/9202200201203201/The-Mighty-Quinns-Sean-The-Mighty-Quinns-7-by-Kate-Hoffmann.pdf
    • http://xiixmcuin.linkpc.net/2209205205207207/Mighty-Jack-and-the-Goblin-King-Mighty-Jack-2-by-Ben-Hatke.pdf
    • http://xiixmcuin.linkpc.net/6209204200209209/Alice-Aventuras-de-Alice-no-Pa-s-das-Maravilhas-amp-Atrav-s-do-Espelho-e-o-Oue-Alice-Encontrou-Por-L-by-Lewis-Carroll.pdf
    • http://xiixmcuin.linkpc.net/3207204209200203/Alice-s-Cabinet-of-Curiosities-Alice-s-Adventures-in-Wonderland-and-Through-the-Looking-Glass-and-What-Alice-Found-There-by-Constantin-Vaughn.pdf
    • http://xiixmcuin.linkpc.net/1201204207202204207/Thompson-amp-Thompson-Genetics-in-Medicine-with-Student-Consult-Online-Access-by-Robert-L-Nussbaum.pdf
    • http://xiixmcuin.linkpc.net/2209205205207206/Mighty-Jack-Mighty-Jack-1-by-Ben-Hatke.pdf
    • http://xiixmcuin.linkpc.net/1200207209207203204/The-Lost-King-of-Oz-Oz-Thompson-and-others-19-by-Ruth-Plumly-Thompson.pdf
    • http://xiixmcuin.linkpc.net/7207205207209205/---Alice-in-Wonderland-Comic-Anthology-Kiwami---Fushigi-no-Kuni-no-Alice-Alice-in-Wonderland-Anthology-by-Jun-Mochizuki.pdf
    • http://xiixmcuin.linkpc.net/1200207203202205203/Alice-in-Wonderland-Le-avventure-d-Alice-nel-Paese-delle-Meraviglie-by-Lewis-Carroll.pdf
    • http://xiixmcuin.linkpc.net/3204203203200/Through-the-Looking-Glass-and-What-Alice-Found-There-Alice-s-Adventures-in-Wonderland-2-by-Lewis-Carroll.pdf
    • http://xiixmcuin.linkpc.net/2202203203207204/Today-I-m-Alice-a-memoir-of-multiple-personality-disorder-by-Alice-Jamieson.pdf
    • http://xiixmcuin.linkpc.net/6200203208209209/Alice-s-Adventures-in-Wonderland-Through-the-Looking-Glass-and-What-Alice-Found-There-by-Lewis-Carroll.pdf
    • http://xiixmcuin.linkpc.net/1201208208200207208/Alice-hinter-den-Spiegeln-Alice-im-Wunderland-Briefe-an-kleine-M-dchen-by-Lewis-Carroll.pdf
    • http://xiixmcuin.linkpc.net/6209203209205203/Alice-s-Drive-Republishing-Veil-Duster-and-Tire-Iron-by-Alice-Ramsey-by-Gregory-W-Franzwa.pdf
    • http://xiixmcuin.linkpc.net/6209204200209209/Alice-Aventuras-de-Alice-no-Pa-s-das-Maravilhas-amp-Atrav-s-do-Espelho-e-o-Oue-Alice-Encontrou-Por-L-

Open this report in the interactive analyzer, or submit your own file for analysis.