Malicious PDF — malware analysis report

Static analysis result for SHA-256 7965f1ed6b9fe276…

MALICIOUS

PDF

23.1 KB Created: 2019-05-02 17:52:25 +01:00 Authoring application: mPDF 5.7
MD5: a17b995ed760af334427413102cd2496 SHA-1: bcece7c199a3bcc8b0bacefbcd9897d5e8826a01 SHA-256: 7965f1ed6b9fe276227e93a44fad69b9cea7ab7fc435e95e08cb86b610103b29
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The sample is a PDF document that contains a large number of embedded links to external PDF files hosted on the dynamic DNS domain 'cmeinasaoo.duckdns.org'. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to potentially malicious or unwanted content. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/1b22b23b20b28b27/Kissing-in-Italian-Flirting-in-Italian-2-by-Lauren-Henderson.pdf
    • http://cmeinasaoo.duckdns.org/9b28b22b21b21b22/Untitled-Flirting-in-Italian-3-by-Lauren-Henderson.pdf
    • http://cmeinasaoo.duckdns.org/3b20b28b23b27b22/The-Italian-s-Perfect-Lover-Italian-Lovers-1-by-Diana-Fraser.pdf
    • http://cmeinasaoo.duckdns.org/1b21b24b28b25b23b22/Kitchen-tested-italian-recipes-Minestrone-Cannelloni-Lasagna-Verdi-Saltimbocca-Milano-Cauliflower-Marinara-Cappucino-Italian-Raisin-Cake-and-many-more-by-Lucy-Luc.pdf
    • http://cmeinasaoo.duckdns.org/8b25b27b29b22b25/Gennaro-s-Italian-Family-Favourites-Authentic-recipes-from-an-Italian-kitchen-by-Gennaro-Contaldo.pdf
    • http://cmeinasaoo.duckdns.org/5b22b23b23b26b28/Thinking-Italian-Translation-A-Course-in-Translation-Method-Italian-to-English-by-Sandor-Hervey.pdf
    • http://cmeinasaoo.duckdns.org/6b25b27b21b25b26/Catalogue-of-Sumptuous-Textiles-Venetian-Gothic-Velvets-Old-Flemish-Tapestries-Rare-Italian-Velours-Spanish-and-Italian-Embroideries-French-and-Venetian-Brocades-Exceedingly-Fine-Old-Venetian-and-Point-a-la-Rose-Laces-Productions-of-the-16th-17th-by-American-Art-Association.pdf
    • http://cmeinasaoo.duckdns.org/7b21b28b28b29b23/Limoncello-Tiramisu-Recipe-from-The-Basic-Art-of-Italian-Cooking-Holidays-and-Special-Occasions-2nd-edition-The-Basic-Art-of-Italian-Cooking-Holidays-and-Special-Occasions-2nd-edition-by-Maria-Liberati.pdf
    • http://cmeinasaoo.duckdns.org/1b27b29b29b23b28/Wish-You-Were-Italian-If-Only--2-by-Kristin-Rae.pdf
    • http://cmeinasaoo.duckdns.org/4b26b25b21b22b27/The-Italian-by-Ann-Radcliffe.pdf
    • http://cmeinasaoo.duckdns.org/6b24b25b21b22b20/The-Italian-Renaissance-by-J-H-Plumb.pdf
    • http://cmeinasaoo.duckdns.org/1b29b21b24b25b22/Italian-Neighbors-by-Tim-Parks.pdf
    • http://cmeinasaoo.duckdns.org/7b24b23b29/The-Italian-Teacher-by-Tom-Rachman.pdf
    • http://cmeinasaoo.duckdns.org/1b20b24b21b26b27b21/Italian-Khana-by-Ritu-Dalmia.pdf
    • http://cmeinasaoo.duckdns.org/6b25b20b29b27b20/Italian-Invader-by-Jessica-Steele.pdf
    • http://cmeinasaoo.duckdns.org/7b24b27b23b24b20/A-Guide-to-Composition-in-Italian-Key-by-Cerutti.pdf
    • http://cmeinasaoo.duckdns.org/1b21b29b22b28b28b23/Italian-Espresso-workbook-1-by-Bultrini.pdf
    • http://cmeinasaoo.duckdns.org/4b29b23b22b21b28/The-Italian-Secretary-by-Caleb-Carr.pdf
    • http://cmeinasaoo.duckdns.org/4b23b26b27b24b27/An-Italian-Affair-by-Laura-Fraser.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b25b24b29b25/Italian-Without-the-Fuss-LL-by-Living-Language.pdf