Malicious PDF — malware analysis report

Static analysis result for SHA-256 79c1d1c8e7d4252d…

MALICIOUS

PDF

25.7 KB Created: 2020-03-18 18:31:15 +00:00 Authoring application: mPDF 5.7 First seen: 2021-10-11
MD5: 2b1bae108a1bc5f249bfb069d9136e3a SHA-1: 19804ff1430a23a5b9e83b9ce2ddd2a389fbca58 SHA-256: 79c1d1c8e7d4252dd5e39b074650a3cd1f3fca5f142d8f4bd44f77b4ea790c31
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ML classifier also flagged this PDF as malicious with high confidence. The embedded URLs point to a domain that appears to be hosting a link farm, suggesting a potential distribution or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9903

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solosopos.myhome.cx/1850858851850850854/M-nchner-K-nstler-Besuche---Eduard-Gr-tzner-by-Michael-Georg-Conrad.pdf In PDF document text
    • http://solosopos.myhome.cx/9853854858852854/Die-Stimme-des-Blutes-by-Michael-Georg-Conrad.pdfIn PDF document text
    • http://solosopos.myhome.cx/1859851854859851/Das-gro-e-Khalil-Gibran-Lesebuchmit-seinem-Bekanntesten-Buch-der-Prophet-in-der-U-bersetzung-von-Georg-Eduard-Freiherr-von-Stietencron-by-Kahlil-Gibran.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850850857857857855/Gesammelte-Werke-Eduard-von-Keyserlings-by-Eduard-von-Keyserling.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850852858857852855/Einf-hrung-in-die-deutsche-Kom-die-by-Georg-Michael-Schulz.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850859850852859851/The-Poet-s-Madness-A-Reading-of-Georg-Trakl-by-Francis-Michael-Sharp.pdfIn PDF document text
    • http://solosopos.myhome.cx/1851852851859853859/Kunst-Und-K-nstler-in-Frankfurt-Am-Main-Im-Neunzehnten-Jahrhundert-by-Heinrich-Weizsacker.pdfIn PDF document text
    • http://solosopos.myhome.cx/6855851851851857/Internationales-Verzeichnis-Der-Monogramme-Bildender-K-nstler-Des-19-Und-20-Jahrhunderts-International-List-of-Monograms-in-the-Visual-Arts-of-the-19th-and-20th-Centuries-by-Paul-Pfisterer.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850850857857857856/Werke-von-Eduard-von-Keyserling-by-Eduard-von-Keyserling.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850858850855858854/Dr-Johann-Georg-Kr-nitz-s-konomisch-Technologische-Encyklop-die-Oder-Allgemeines-System-Der-Staats-Stadt-Haus-Und-Landwirthschaft-Und-Der-Kunstgeschichte-in-Alphabetischer-Ordnung-Vol-153-Welcher-Die-Artikel-Seil-Bis-Sieckenstockbahn-Enth-lt-by-Johann-Georg-Krunitz.pdfIn PDF document text
    • http://solosopos.myhome.cx/9854853856859853/Tagebuch-eines-Minecraft-Zombies-Alles-ber-meine-Besuche-im-Nether-meine-Freunde-Creepy-und-Schleimi-und-die-h-ssliche-Hexe-von-nebenan-by-Herobrine-Books.pdfIn PDF document text
    • http://solosopos.myhome.cx/6855851858859859/Heart-of-Darkness-Joseph-Conrad-by-Joseph-Conrad.pdfIn PDF document text
    • http://solosopos.myhome.cx/8857855853855859/The-Short-Stories-of-Conrad-Aiken-by-Conrad-Aiken.pdfIn PDF document text
    • http://solosopos.myhome.cx/1851858857851853857/Heart-of-Darkness-the-Classic-Novel-by-Joseph-Conrad-Classic-Books-by-Joseph-Conrad.pdfIn PDF document text
    • http://solosopos.myhome.cx/8853852859858854/Horace-by-Eduard-Fraenkel.pdfIn PDF document text
    • http://solosopos.myhome.cx/5852850856852857/Christened-with-Crosses-by-Eduard-Kochergin.pdfIn PDF document text
    • http://solosopos.myhome.cx/1851858858855854854/Mord-in-Lubeck-by-Eduard-von-Steynfurth.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850851852852854857/ENDSTATION-DARKNET-by-Eduard-Hartmann.pdfIn PDF document text
    • http://solosopos.myhome.cx/1851856850851857856/Morgue-of-the-Living-by-Eduard-Joseph.pdfIn PDF document text
    • http://solosopos.myhome.cx/1850859850852853855/Georg-Trakl-A-Profile-by-Georg-Trakl.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.