Malicious PDF — malware analysis report

Static analysis result for SHA-256 86cd22480729eb04…

MALICIOUS

PDF

15.5 KB Created: 2019-05-02 18:07:32 +01:00 Authoring application: mPDF 5.7
MD5: 65b51bed9e72d2fbbc915da5547ecffb SHA-1: 1c9a2dce3c025352164c977b952a782d8744a564 SHA-256: 86cd22480729eb04a5b2a2701f318cba294127877273da27960d92d1998614ef
92 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded links to external URLs, identified by the PDF_SEO_LINK_FARM heuristic. These links, such as http://kiteeearpdf.myhome.cx/3f215f216f212f215f210/Razorblade-Kisses-by-R-L-Griffin.pdf, suggest a link farm or a method to distribute malicious content. The ML_NYX_PDF_MALICIOUS heuristic also flagged this PDF with high confidence. No scripts were extracted, but the structure indicates a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9200

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kiteeearpdf.myhome.cx/3f215f216f212f215f210/Razorblade-Kisses-by-R-L-Griffin.pdf
    • http://kiteeearpdf.myhome.cx/3f217f216f216f218f211/Christmas-Eve-Kisses-Inspy-Kisses-4-by-Margaret-Daley.pdf
    • http://kiteeearpdf.myhome.cx/1f212f218f214f216f212/Saltwater-Kisses-The-Kisses-Series-1-by-Krista-Lakes.pdf
    • http://kiteeearpdf.myhome.cx/1f211f218f210f213f211f218/Butterfly-Kisses-All-My-Kisses-Book-1-by-Robin-Rance.pdf
    • http://kiteeearpdf.myhome.cx/3f219f213f213f219f212/Wishful-Kisses-The-Kisses-4-5-by-Krista-Lakes.pdf
    • http://kiteeearpdf.myhome.cx/5f217f217f210f216f215/Country-Kisses-3-AM-Kisses-7-by-Addison-Moore.pdf
    • http://kiteeearpdf.myhome.cx/4f213f213f217f212f216/3-AM-Kisses-3-AM-Kisses-1-by-Addison-Moore.pdf
    • http://kiteeearpdf.myhome.cx/1f210f216f213f214f211f219/Griffin-s-Storm-Griffin-3-by-Darby-Karchut.pdf
    • http://kiteeearpdf.myhome.cx/3f210f212f217f216/Griffin-s-Fire-Griffin-2-by-Darby-Karchut.pdf
    • http://kiteeearpdf.myhome.cx/7f213f210f214f218f210/Poison-Kisses-Part-2-Poison-Kisses-2-by-Lisa-Renee-Jones.pdf
    • http://kiteeearpdf.myhome.cx/4f214f213f214f218/Official-Book-Club-Selection-A-Memoir-According-to-Kathy-Griffin-by-Kathy-Griffin.pdf
    • http://kiteeearpdf.myhome.cx/3f214f212f213f212/Vampire-Kisses-Vampire-Kisses-1-by-Ellen-Schreiber.pdf
    • http://kiteeearpdf.myhome.cx/5f213f210f213f219f214/Decorating-With-Decoupage-Handmade-Gifts-And-Accessories-Using-Anna-Griffin-s-New-Decoupe-Papers-A-Step-By-Step-Guide-To-Creating-Over-42-Easy-To-Make-Projects-by-Anna-Griffin.pdf
    • http://kiteeearpdf.myhome.cx/3f217f215f215f213/Griffin-and-Sabine-Griffin-amp-Sabine-1-by-Nick-Bantock.pdf
    • http://kiteeearpdf.myhome.cx/9f215f219f218f210f213/The-Flight-of-the-Griffin-The-Flight-of-the-Griffin-1-by-C-M-Gray.pdf
    • http://kiteeearpdf.myhome.cx/4f213f211f212f218f217/400-First-Kisses-First-1-by-E-L-Todd.pdf
    • http://kiteeearpdf.myhome.cx/4f216f213f212f212f219/Lenin-s-Kisses-by-Yan-Lianke.pdf
    • http://kiteeearpdf.myhome.cx/2f211f218f217f214f215/Crimson-Kisses-by-Asa-Drake.pdf
    • http://kiteeearpdf.myhome.cx/4f215f211f219f219f214/17-First-Kisses-by-Rachael-Allen.pdf
    • http://kiteeearpdf.myhome.cx/4f218f210f211f214f215/Where-Do-Kisses-Come-From-by-Maria-Fleming.pdf