Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c974987f3278c3f…

MALICIOUS

PDF

39.2 KB Created: 2019-04-30 03:25:06 +01:00 Authoring application: mPDF 5.7
MD5: 31210a8a374a66ee50375049bf273f5d SHA-1: 4d1b50994081faa5d87267628c40c3106c4d6042 SHA-256: 8c974987f3278c3f663a78bd59d4f29f8c8714781052941f3a95f131ce2a914f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by a machine learning classifier as malicious. Static analysis revealed a large number of embedded URLs, characteristic of a link farm. While most of these URLs were classified as benign, the sheer volume and the ML classification suggest a malicious intent, possibly for SEO manipulation or to distribute further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9703

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/1a00a05a09a06a05a01/Waldschutzgebiet-Liste-Der-Schutzgebiete-in-Baden-Wurttemberg-Urwald-Weisswasser-Bannwald-Nationalpark-Garajonay-Schutzwald-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/8a06a01a01a07a09/Wo-Fehlen-Wohnungen-in-Baden-Wurttemberg-Eine-Wohnungsbedarfsprognose-Fur-Baden-Wurttemberg-Und-Seine-Stadt--Und-Landkreise-by-Wolfgang-Walla.pdf
    • http://muicuiu.dumb1.com/1a00a07a01a02a07a08/Friedhof-in-Deutschland-Friedhof-Im-Saarland-Friedhof-in-Baden-Wurttemberg-Friedhof-in-Bayern-Friedhof-in-Berlin-Friedhof-in-Brandenburg-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a00a04a01a02a03a04/Hohle-in-Baden-Wurttemberg-Hohle-Im-Alb-Donau-Kreis-Hohle-Im-Landkreis-Esslingen-Hohle-Im-Landkreis-Heidenheim-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/9a04a04a07a02a04/Judisches-Museum-in-Deutschland-Judisches-Museum-in-Baden-Wurttemberg-Judisches-Museum-in-Bayern-Judisches-Museum-in-Rheinland-Pfalz-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/8a06a02a00a09a03/Liste-Brunnen-Liste-Der-Denkmaler-Brunnen-Und-Skulpturen-in-Rostock-Liste-Der-Brunnen-Und-Wasserspiele-in-Dresden-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/9a04a04a07a02a05/Judische-Gemeinde-in-Deutschland-Judische-Gemeinde-in-Baden-Wurttemberg-Judische-Gemeinde-in-Bayern-Judische-Gemeinde-in-Hessen-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a06a03a00a04a08/Politik-Mexiko-Deutscher-Botschafter-in-Mexiko-Liste-Diplomatisches-Corps-in-Mexiko-Liste-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a00a03a00a01a07a06/Platz-in-Wien-Heldenplatz-Liste-Der-Strassennamen-Von-Wien-Donaustadt-Liste-Der-Strassennamen-Von-Wien-Floridsdorf-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/8a08a02a01a02a00/Die-Afd-VOR-Der-Landtagswahl-in-Baden-Wurttemberg-by-Julia-Sohne.pdf
    • http://muicuiu.dumb1.com/1a01a01a09a08a03a00/Museum-in-Hamburg-Hamburger-Kunsthalle-Miniatur-Wunderland-Liste-Der-Museen-in-Hamburg-Freilichtmuseum-Am-Kiekeberg-Ballinstadt-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a04a07a06a08a05/Bauwerk-in-Heilbronn-Liste-Heilbronner-Bauwerke-Neckar-Enz-Stellung-Rathaus-Robert-Mayer-Volks--Und-Schulsternwarte-Heilbronn-Deutschhof-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a06a04a03a01a08/Lienz-Liste-Der-Denkmalgeschutzten-Objekte-in-Lienz-Von-Graben-Von-Stein-Sv-Rapid-Lienz-Dolomitenmann-Snowboard-Weltmeis-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a00a04a01a04a09a08/Kirchengebaude-in-Moskau-Liste-Der-Kirchen-in-Moskau-Kathedrale-Der-Unbefleckten-Empfangnis-Maria-Entschlafens-Kathedrale-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a00a03a06a08a05a04/Kraftwerk-in-Russland-Kernkraftwerk-in-Russland-Wasserkraftwerk-in-Russland-Liste-Der-Kerntechnischen-Anlagen-in-Russland-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/6a01a01a07a08a07/Verwaltungsgliederung-Latium-Comunita-Montana-Im-Latium-Fraktion-Im-Latium-Gemeinde-Im-Latium-ROM-Liste-Der-Gemeinden-in-Latium-Sutri-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a09a08a08a01a04/Fluchthilfe-Fluchthelfer-Judenretter-Resistance-Kindertransport-Gerechter-Unter-Den-Volkern-Danischer-Widerstand-Fluchttunnel-Wollankstrasse-Bricha-Liste-Der-Fluchttunnel-in-Berlin-Wahrend-Der-Deutschen-Teilung-Rettung-Der-Danischen-Juden-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a00a08a03a01a08a07/Uebigau-Wahrenbruck-Uebigau-Verlorener-Zug-Prestewitz-Drasdo-Liste-Der-Baudenkmale-in-Uebigau-Wahrenbruck-Wiederau-Bonitz-Saxdorf-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/9a01a03a08a03a05/Berlin-Prenzlauer-Berg-Mauerpark-Grenzubergang-Bornholmer-Strasse-Liste-Der-Strassen-Und-Platze-in-Berlin-Prenzlauer-Berg-Schonhauser-Allee-by-Quelle-Wikipedia.pdf
    • http://muicuiu.dumb1.com/1a01a06a04a03a08a00/Strasse-in-Wien-Innere-Stadt-Liste-Der-Strassennamen-Von-Wien-Innere-Stadt-Graben-Wiener-Ringstrasse-Schottengasse-Molker-Bastei-by-Quelle-Wikipedia.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.