Malicious PDF — malware analysis report

Static analysis result for SHA-256 8bd36a928d093103…

MALICIOUS

PDF

21.5 KB Created: 2020-03-18 21:47:36 +00:00 Authoring application: mPDF 5.7
MD5: b4e30a18580684e4d4106a1af449af61 SHA-1: 64230c3c48f2decd88bf6f8f98fa4d0998c278b4 SHA-256: 8bd36a928d093103f988cc648c626aa4eee7f4736eeca7802617512d9deeb3af
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or SEO poisoning attack. The ML_NYX_PDF_MALICIOUS heuristic also flagged the document with high confidence. No scripts were extracted from this sample. The primary attack pattern involves redirecting users to a multitude of external sites hosted on rtuninnsi.myhome.cx.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9919

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rtuninnsi.myhome.cx/56a56a36a96a26a2/Paris-the-Provinces-and-the-French-Revolution-by-Alan-Forrest.pdf
    • http://rtuninnsi.myhome.cx/86a36a76a06a36a2/Guide-Na-f-Des-Provinces-De-France-French-Provinces-Through-The-Eyes-Of-The-Modern-Primitives-by-Marie-Christine-Hugonot.pdf
    • http://rtuninnsi.myhome.cx/76a06a86a26a56a7/The-first-expatriates-Americans-in-Paris-during-the-French-Revolution-by-Yvon-Bizardel.pdf
    • http://rtuninnsi.myhome.cx/46a46a66a96a36a3/The-Vanishing-Children-of-Paris-Rumor-and-Politics-before-the-French-Revolution-by-Arlette-Farge.pdf
    • http://rtuninnsi.myhome.cx/56a56a96a16a86a5/French-Toast-An-American-in-Paris-Celebrates-the-Maddening-Mysteries-of-the-French-by-Harriet-Rochefort.pdf
    • http://rtuninnsi.myhome.cx/56a56a96a16a86a4/French-Toast-An-American-in-Paris-Celebrates-the-Maddening-Mysteries-of-the-French-by-Harriet-Welty-Rochefort.pdf
    • http://rtuninnsi.myhome.cx/56a56a36a96a96a6/Change-In-The-Provinces-The-Seventeenth-Century-by-Alan-Milner-Everitt.pdf
    • http://rtuninnsi.myhome.cx/66a26a96a66a16a4/The-Paris-Commune-A-Revolution-in-Democracy-by-Donny-Gluckstein.pdf
    • http://rtuninnsi.myhome.cx/56a36a96a06a66a1/The-French-Revolution-by-Georges-Lefebvre.pdf
    • http://rtuninnsi.myhome.cx/86a56a46a26a96a0/Beethoven-and-the-French-Revolution-by-Fan-S-Noli.pdf
    • http://rtuninnsi.myhome.cx/26a76a96a56a16a9/The-French-Revolution-and-What-Went-Wrong-by-Stephen-Clarke.pdf
    • http://rtuninnsi.myhome.cx/66a06a16a36a56a4/The-French-Revolution-Volume-III-by-Hippolyte-Taine.pdf
    • http://rtuninnsi.myhome.cx/86a06a26a46a36a0/In-Palace-and-Faubourg-A-Story-of-the-French-Revolution-by-T-F-G-.pdf
    • http://rtuninnsi.myhome.cx/56a36a96a16a56a5/The-French-Revolution-2-Vols-by-Georges-Lefebvre.pdf
    • http://rtuninnsi.myhome.cx/46a36a76a06a76a4/From-Here-You-Can-t-See-Paris-Seasons-of-a-French-Village-and-Its-Restaurant-by-Michael-S-Sanders.pdf
    • http://rtuninnsi.myhome.cx/66a46a76a26a56a2/The-Unruly-City-London-Paris-and-New-York-in-the-Age-of-Revolution-by-Mike-Rapport.pdf
    • http://rtuninnsi.myhome.cx/26a26a26a46a16a9/Citizens-A-Chronicle-of-the-French-Revolution-by-Simon-Schama.pdf
    • http://rtuninnsi.myhome.cx/76a66a56a46a16a6/Scaramouche-A-Romance-of-the-French-Revolution-by-Rafael-Sabatini.pdf
    • http://rtuninnsi.myhome.cx/86a46a96a46a16a4/Compromising-Of-Louis-XVI-The-armoire-de-fer-and-the-French-Revolution-by-E-Freeman.pdf
    • http://rtuninnsi.myhome.cx/66a26a46a96a56a2/A-Tale-of-Two-Cities-A-Story-of-the-French-Revolution-by-Charles-Dickens.pdf
    • http://rtuninnsi.myhome.cx/56a56a96a16a86a5/French-Toast-An-American-in-Paris-Cele

Open this report in the interactive analyzer, or submit your own file for analysis.