Malicious PDF — malware analysis report

Static analysis result for SHA-256 7af3901e2c23db45…

MALICIOUS

PDF

20.4 KB Created: 2020-03-18 22:09:30 +00:00 Authoring application: mPDF 5.7 First seen: 2020-12-28
MD5: 9bb8cb6990378e6d1d78a3695ff2f480 SHA-1: 785645850fb0b13b525b389b4395574e32d035b6 SHA-256: 7af3901e2c23db452c2a7726498fc7ac9f84f9d1d446b674103012906dcb4a44
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm, suggesting a tactic to manipulate search engine results or redirect users to potentially malicious content. While no scripts were explicitly extracted, the presence of embedded URLs within a PDF often implies an attempt to leverage JavaScript for redirection or further exploitation. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9942

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lwoscmobook.myhome.cx/152435243524652485249/The-Witch-the-Wolf-and-the-Vampire-The-Witch-The-Wolf-and-The-Vampire-1-by-A-K-Michaels.pdf In PDF document text
    • http://lwoscmobook.myhome.cx/252445241524952475246/The-Witch-Who-Cried-Wolf-Cry-Wolf-1-by-Sarah-M-kel-.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/452465245524052475240/Kiera-Hudson-Limited-Edition-Series-One-Vampire-Breed-Wolf-House-amp-Vampire-Hollows-Book-2-by-Tim-O-39-Rourke.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/652415241524352485246/Winter-Wolf-Witch-amp-Wolf-1-by-R-J-Blain.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/652415241524352485244/Inquisitor-Witch-amp-Wolf-2-by-R-J-Blain.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352405244524752425242/The-Witch-and-the-Wolf-by-Tricia-Schneider.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/152475244524952445247/The-Vampire-s-Wolf-by-Jenna-Kernan.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/452485241524352455246/A-New-Orleans-Christmas-The-Vampire-The-Witch-and-The-Werewolf-1-by-Louisa-Bacio.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/1524152405249524952435249/A-New-Orleans-Threesome-The-Vampire-The-Witch-and-The-Werewolf-2-by-Louisa-Bacio.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352435244524652455245/A-New-Orleans-Threesome-The-Vampire-The-Witch-and-The-Werewolf-2-by-Louisa-Bacio.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475245524352445246/The-Spirit-of-a-Witch-The-Briley-Witch-Chronicles-1-by-Sarah-Jane-Avory.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/852485243524252415248/Edmund-and-the-White-Witch-The-Chronicles-of-Narnia-The-Lion-the-Witch-and-the-Wardrobe-by-Scout-Driggs.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852465242/Witch-is-When-The-Bubble-Burst-A-Witch-P-I-Mystery-5-by-Adele-Abbott.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/252495245524052405244/A-Witch-Central-Wedding-A-Modern-Witch-3-5-by-Debora-Geary.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852465245/Witch-Is-When-Life-Got-Complicated-A-Witch-P-I-Mystery-2-by-Adele-Abbott.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352425247524952455245/Witch-Weed-Witch-Saga-5-by-Phyllis-Reynolds-Naylor.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852445249/Witch-Is-Why-The-Laughter-Stopped-A-Witch-P-I-Mystery-14-by-Adele-Abbott.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852455246/Witch-is-When-My-Heart-Broke-A-Witch-P-I-Mystery-9-by-Adele-Abbott.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852445242/Witch-Is-Why-The-Music-Stopped-A-Witch-P-I-Mystery-19-by-Adele-Abbott.pdfIn PDF document text
    • http://lwoscmobook.myhome.cx/352475246524852465240/Witch-Is-When-The-Floodgates-Opened-A-Witch-P-I-Mystery-7-by-Adele-Abbott.pdfIn PDF document text

Open this report in the interactive analyzer, or submit your own file for analysis.