Malicious PDF — malware analysis report

Static analysis result for SHA-256 79489914a38a5408…

MALICIOUS

PDF

17.1 KB Created: 2019-04-30 17:50:34 +01:00 Authoring application: mPDF 5.7
MD5: 6ee0eb5bc402a67e786c5657959f1d16 SHA-1: 9db436b4001ce5a60abd998994b788dc3decc1d9 SHA-256: 79489914a38a5408d9eda076c69d21a359610435f119b92f7c34fb270fb8c077
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a link farm. The ML classifier also flagged this PDF as malicious. The primary attack pattern appears to be directing users to a large collection of external PDFs, likely for SEO manipulation or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://xiixmcuin.linkpc.net/1201202205202207208/Haut-wie-Seide-K-sse-wie-Samt-by-Maureen-Child.pdf
    • http://xiixmcuin.linkpc.net/1201208207208204206/Mister-Dynamit-512-Jeder-k-mpft-um-seine-Haut-by-C-H-Guenter.pdf
    • http://xiixmcuin.linkpc.net/9203201207209203/Sand-auf-unserer-Haut-Sterne-in-der-Nacht-by-Sandra-Brown.pdf
    • http://xiixmcuin.linkpc.net/6205201207205203/Pulp-Culture-Hardboiled-Fiction-the-Cold-War-by-Woody-Haut.pdf
    • http://xiixmcuin.linkpc.net/7200204209206208/Haut-Jura-Diptyque-de-Saint-Claude-by-Daniel-Moutote.pdf
    • http://xiixmcuin.linkpc.net/6205206207205201/Ciel-bleu-Une-enfance-dans-le-Haut-Alta-by-Galsan-Tschinag.pdf
    • http://xiixmcuin.linkpc.net/5207205207206202/S-raphin-Nouvelles-histoires-des-Pays-d-en-haut-Tome-2-by-Claude-Henri-Grignon.pdf
    • http://xiixmcuin.linkpc.net/6205201207205207/The-Hidden-Library-of-Tanith-Lee-Themes-and-Subtexts-from-Dionysos-to-the-Immortal-Gene-by-Mavis-Haut.pdf
    • http://xiixmcuin.linkpc.net/9207203203204200/Descendants-of-John-Peter-Scholl-and-His-Wife-Anna-Susanna-Dorothea-Scholl-by-Alton-G-Scholl.pdf
    • http://xiixmcuin.linkpc.net/2205205200200201/Captured-at-Sabine-The-True-Account-of-a-Union-POW-After-the-Battle-of-Sabine-Pass-II-by-Stephen-Wright.pdf
    • http://xiixmcuin.linkpc.net/9207203204206203/Geneva-and-Western-Switzerland-Reinhard-Scholl-by-Reinhard-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203201207204/A-Cowboy-in-the-Hay-by-Genevieve-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203203203204/David-Archuleta-by-Elizabeth-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203200208203/Callow-Ardenti-Terra-1-by-N-S-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203201208204/Showering-with-a-Ghost-by-Genevieve-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203202203202/Organic-Gardening-for-Kids-by-Elizabeth-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203204206201/The-Forty-Eight-State-Scholl-Systems-by-Anonymous.pdf
    • http://xiixmcuin.linkpc.net/9207203204205208/T-chter-Des-Krieges-berleben-In-Tschetschenien-by-Susanne-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203204204208/Microservices-with-Docker-on-Microsoft-Azure-by-Boris-Scholl.pdf
    • http://xiixmcuin.linkpc.net/9207203203203206/Blade-Of-The-Broken-The-Runeblade-Trilogy-1-by-Jake-Scholl.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.