Malicious PDF — malware analysis report

Static analysis result for SHA-256 7a1368755af82e83…

MALICIOUS

PDF

21.7 KB Created: 2019-05-01 19:26:17 +01:00 Authoring application: mPDF 5.7
MD5: 878ce866301899c4c3013b309eb10ae7 SHA-1: c20965c2af469beeabfb22158f74baf9883c333d SHA-256: 7a1368755af82e83d73272658f70f77b3000064d04ae8a38928a68b7ff3b20a5
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links pointing to external PDF files hosted on a dynamic DNS domain. This behavior is indicative of a link farm or a lure to download further content, potentially malicious. The ML classifier also flagged this PDF as malicious with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9925

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmeinasaoo.duckdns.org/4b26b21b20b27b29/Silvermeadow-Brock-And-Kolla-5-by-Barry-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/1b21b23b24b20b25/No-Trace-Brock-amp-Kolla-8-by-Barry-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/4b20b25b22b24b23/Crucifixion-Creek-The-Belltree-Trilogy-1-by-Barry-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/2b20b24b22b28b27/Angel-Maker-The-Short-Stories-of-Sara-Maitland-by-Sara-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b24b21b25b25/Tierra-Kolla-by-Ana-Maria-Iglesias.pdf
    • http://cmeinasaoo.duckdns.org/8b22b28b23b23b25/Ivanhoe-A-Romance-By-Walter-Scott-Illustrated-Historical-Novel-Chivalric-Romance-Edited-By-Porter-Lander-MacClintock-Born-1861-Died-1939-and-Illustrated-By-C-E-Brock-charles-Edmund-Brock-5-February-1870---28-February-1938-Was-a-Widely-by-Walter-Scott.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b24b22b22b22/Nominativ-Joe-Kolla-s-1-Fall-by-Leopold-Kronwinkler.pdf
    • http://cmeinasaoo.duckdns.org/4b27b26b25b24b29/Barry-The-Story-Of-Motorcycling-Legend-Barry-Sheene-by-Steve-Parrish.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b24b22b22b23/Camba-and-Kolla-Migration-and-Development-in-Santa-Cruz-Bolivia-by-Allyn-MacLean-Stearman.pdf
    • http://cmeinasaoo.duckdns.org/1b20b21b24b22b22b27/The-Concept-of-Parinama-in-Indian-Philosophy-A-Critical-Study-with-Reference-to-Samkhya-Yoga-by-Kolla-Chenchulakshmi.pdf
    • http://cmeinasaoo.duckdns.org/3b24b29b21b21b20/Live-Right-and-Find-Happiness-Although-Beer-is-Much-Faster-Life-Lessons-and-Other-Ravings-from-Dave-Barry-by-Dave-Barry.pdf
    • http://cmeinasaoo.duckdns.org/4b22b28b22b29b21/Memoirs-of-the-Comtesse-Du-Barry-with-Minute-Details-of-Her-Entire-Career-as-Favorite-of-Louis-XV-by-Comtesse-du-Barry.pdf
    • http://cmeinasaoo.duckdns.org/3b25b24b21b21b27/I-ll-Mature-When-I-m-Dead-Dave-Barry-s-Amazing-Tales-of-Adulthood-by-Dave-Barry.pdf
    • http://cmeinasaoo.duckdns.org/4b21b22b29b21b22/How-to-Be-Alone-by-Sara-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/6b20b25b26b25b23/How-to-Be-Alone-by-Sara-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/2b29b25b23b23b21/Dave-Barry-s-Bad-Habits-A-100-Fact-Free-Book-by-Dave-Barry.pdf
    • http://cmeinasaoo.duckdns.org/8b24b28b22b23b23/Barry-Baskerville-Solves-a-Case-Barry-Baskerville-1-by-Richard-L-Kellogg.pdf
    • http://cmeinasaoo.duckdns.org/4b27b20b28b26/The-Owl-Killers-by-Karen-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/3b25b21b27b27b22/The-Blood-Well-by-Karen-Maitland.pdf
    • http://cmeinasaoo.duckdns.org/1b20b23b24b22b25/The-Gallows-Curse-by-Karen-Maitland.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.