Malicious PDF — malware analysis report

Static analysis result for SHA-256 967aafa07ee3d3c2…

MALICIOUS

PDF

15.3 KB Created: 2019-04-30 04:48:36 +01:00 Authoring application: mPDF 5.7
MD5: 435c2c99d643d3c302d62489cef7caec SHA-1: f1ede12f062be5566ffd360a38125218d81e8650 SHA-256: 967aafa07ee3d3c2da292a904b9eafc53780488f843d469a146fe6683a4fe00f
90 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, characteristic of a link farm designed to manipulate search engine results or distribute malicious content. The ML classifier strongly indicated maliciousness, and the PDF_SEO_LINK_FARM heuristic identified the link farm pattern. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9778

Heuristics 2

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://muicuiu.dumb1.com/5a00a04a02a00/The-Ghost-in-the-Big-Brass-Bed-Nina-Tanleven-3-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a03a06a03a03a05/The-Ghost-in-the-Third-Row-Nina-Tanleven-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a00a08a06a05a01/The-Ghost-in-the-Third-Row-Nina-Tanleven-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/1a01a02a01a05a09/Bruce-Coville-s-Book-of-Nightmares-II-More-Tales-to-Make-You-Scream-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a05a05a09a01a02/Oddly-Enough-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/6a07a02a06a00/Goblins-in-the-Castle-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/1a00a09a06a01a08a04/William-Shakespeare-s-The-Tempest-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/4a01a07a01a07a03/The-Naughty-Nork-Moongobble-and-Me-5-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/4a06a06a02a08/Dark-Whispers-Unicorn-Chronicles-3-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/1a08a00a06a07a02/The-Search-for-Snout-Alien-Adventures-3-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/4a00a04a09a04a09/Into-the-Land-of-the-Unicorns-Unicorn-Chronicles-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/4a00a08a00a02/Into-the-Land-of-the-Unicorns-Unicorn-Chronicles-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a04a04a08a01a09/Aliens-Stole-My-Body-Alien-Adventures-4-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/1a06a02a05a03a03/My-Teacher-Glows-in-the-Dark-My-Teacher-Is-an-Alien-3-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a04a04a08a05a09/My-Teacher-Fried-My-Brains-My-Teacher-Is-an-Alien-2-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/2a00a07a09a07/Ghost-of-a-Chance-Frenchman-s-Island-1-by-Nina-Bruhns.pdf
    • http://muicuiu.dumb1.com/3a08a01a08a06a06/Ghost-Doll-by-Bruce-McMillan.pdf
    • http://muicuiu.dumb1.com/1a08a04a02a06a06/My-Teacher-is-an-Alien-My-Teacher-is-an-Alien-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/5a04a01a06a05/My-Teacher-Is-an-Alien-My-Teacher-Is-an-Alien-1-by-Bruce-Coville.pdf
    • http://muicuiu.dumb1.com/4a06a03a07a03a05/Bonds-of-Brass-Bonds-of-Brass-1-by-Emily-Skrutskie.pdf
    • http://muicuiu.dumb1.com/4a00a08a00a02/Into-the-Land-of-the-Unicorns-

Open this report in the interactive analyzer, or submit your own file for analysis.