Malicious PDF — malware analysis report

Static analysis result for SHA-256 92de3e4ed0345abe…

MALICIOUS

PDF

15.2 KB Created: 2019-05-02 01:19:24 +01:00 Authoring application: mPDF 5.7
MD5: 8f057a656f1064e1835c625a701cbcb1 SHA-1: 7671c6dc00ed4b30163828c272ecbe016d687e3b SHA-256: 92de3e4ed0345abecefb53b45c7cc2593b1c37fd0b2206fd89a4a38dc14a1ca2
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic. While the URLs themselves are marked as benign, the sheer volume and structure suggest a malicious intent, possibly for SEO poisoning or to redirect users to malicious content. The ML_NYX_PDF_MALICIOUS classifier also flagged this file with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9880

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/4a01a01a06a09/Five-Go-to-Smuggler-s-Top-Famous-Five-4-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/2a09a03a05a02a03/Five-Go-to-Smuggler-s-Top-Famous-Five-4-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/4a02a02a09a00/Five-Get-into-a-Fix-Famous-Five-17-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a07a07a03a08a08/Five-Get-into-a-Fix-Famous-Five-17-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/4a07a01a00a02/Five-Go-Off-to-Camp-Famous-Five-7-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/4a08a06a07a06/Five-Have-Plenty-of-Fun-Famous-Five-14-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/8a07a04a05a09/Five-Have-a-Mystery-to-Solve-Famous-Five-20-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/2a08a04a07a06a08/Five-Fall-into-Adventure-Famous-Five-9-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/8a07a08a04a03/Five-on-Finniston-Farm-Famous-Five-18-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/8a09a07a01a06/Five-on-Kirrin-Island-Again-Famous-Five-6-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/1a01a01a08a03a01/The-Brave-Toy-Soldier-and-Other-Stories-Enid-Blyton-s-Popular-Rewards-Series-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a05a07a04a00a08/Enid-Blyton-s-Malory-Towers-6-Books-Collection-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/9a07a08a04a03a05/Enid-Blyton-Collection-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/2a06a09a00a01a04/Four-In-A-Family-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a01a02a05a01a04/Well-Really-Mr-Twiddle-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a07a07a03a07a08/7-Five-Go-Off-To-Camp-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/2a07a03a03a08a05/The-Adventures-of-Pip-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a07a07a03a08a07/Five-Go-to-Billycock-Hill-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/3a08a08a05a00a03/The-Enchanted-Wood-by-Enid-Blyton.pdf
    • http://muicuiu.dumb1.com/2a07a04a04a06a04/Up-the-Faraway-Tree-by-Enid-Blyton.pdf

Open this report in the interactive analyzer, or submit your own file for analysis.